@kici-dev/orchestrator 0.12.0 → 0.13.0

package/dist/cli.js

@@ -1122,13 +1122,13 @@ async function loadAccessLogRange(args) {
 		}
 	} catch (err) {
 		if (cursor?.source === "cold") {
-			logger$25.error("cold-store fetchRange failed during cold-resume; propagating", {
+			logger$26.error("cold-store fetchRange failed during cold-resume; propagating", {
 				tenantId: tenantToScan,
 				error: toErrorMessage(err)
 			});
 			throw err;
 		}
-		logger$25.warn("cold-store fetchRange failed; returning hot rows only", {
+		logger$26.warn("cold-store fetchRange failed; returning hot rows only", {
 			tenantId: tenantToScan,
 			error: toErrorMessage(err)
 		});
@@ -1205,9 +1205,9 @@ function parseCursor(cursor) {
 		return null;
 	}
 }
-var logger$25, SYNTHETIC_ORCH_TENANT;
+var logger$26, SYNTHETIC_ORCH_TENANT;
 var init_load_access_log_range = __esmMin((() => {
-	logger$25 = createLogger({ prefix: "load-access-log-range" });
+	logger$26 = createLogger({ prefix: "load-access-log-range" });
 	SYNTHETIC_ORCH_TENANT = "__orchestrator__";
 }));
 //#endregion
@@ -1230,7 +1230,7 @@ var init_load_access_log_range = __esmMin((() => {
 * partitioned by `(routing_key, day)`, not by the secondary filters.
 */
 init_load_access_log_range();
-const logger$24 = createLogger({ prefix: "load-secret-audit-log-range" });
+const logger$25 = createLogger({ prefix: "load-secret-audit-log-range" });
 async function loadSecretAuditLogRange(args) {
 	const { db, coldStore, contextName, routingKey, action, fromTs, toTs, limit, offset, includeArchived } = args;
 	let hotQuery = db.selectFrom("secret_audit_log").selectAll().orderBy("timestamp", "desc");
@@ -1276,10 +1276,10 @@ async function loadSecretAuditLogRange(args) {
 		}
 	} catch (err) {
 		if (hotRows.length === 0) {
-			logger$24.error("cold-store fetchRange failed with no hot fallback; propagating", { error: toErrorMessage(err) });
+			logger$25.error("cold-store fetchRange failed with no hot fallback; propagating", { error: toErrorMessage(err) });
 			throw err;
 		}
-		logger$24.warn("cold-store fetchRange failed; returning hot rows only", { error: toErrorMessage(err) });
+		logger$25.warn("cold-store fetchRange failed; returning hot rows only", { error: toErrorMessage(err) });
 		return hotRows;
 	}
 	const coldSlice = coldRows.slice(coldOffset, coldOffset + remaining);
@@ -2859,8 +2859,8 @@ server:
 //#endregion
 //#region src/db/migrations/001_initial.ts
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$150,
-	up: () => up$150
+	down: () => down$152,
+	up: () => up$152
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -3552,7 +3552,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$150(db) {
+async function up$152(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -3574,7 +3574,7 @@ async function up$150(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$150(db) {
+async function down$152(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -3621,8 +3621,8 @@ async function down$150(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$149,
-	up: () => up$149
+	down: () => down$151,
+	up: () => up$151
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -3636,13 +3636,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$149(db) {
+async function up$151(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$149(db) {
+async function down$151(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -3651,8 +3651,8 @@ async function down$149(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$148,
-	up: () => up$148
+	down: () => down$150,
+	up: () => up$150
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -3676,7 +3676,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$148(db) {
+async function up$150(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -3714,28 +3714,28 @@ async function up$148(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$148(db) {
+async function down$150(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$147,
-	up: () => up$147
+	down: () => down$149,
+	up: () => up$149
 });
-async function up$147(db) {
+async function up$149(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$147(db) {
+async function down$149(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$146,
-	up: () => up$146
+	down: () => down$148,
+	up: () => up$148
 });
 /**
 * Cold-store chunk counter table.
@@ -3750,7 +3750,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 * write via `INSERT ... ON CONFLICT (db, table_name, tenant_id) DO
 * UPDATE SET chunk_count = chunk_count + EXCLUDED.chunk_count, ...`.
 */
-async function up$146(db) {
+async function up$148(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -3768,14 +3768,14 @@ async function up$146(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$146(db) {
+async function down$148(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$145,
-	up: () => up$145
+	down: () => down$147,
+	up: () => up$147
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -3811,7 +3811,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$145(db) {
+async function up$147(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -3856,7 +3856,7 @@ async function up$145(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$145(db) {
+async function down$147(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -3881,8 +3881,8 @@ async function down$145(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$144,
-	up: () => up$144
+	down: () => down$146,
+	up: () => up$146
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -3919,7 +3919,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$144(db) {
+async function up$146(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -3940,7 +3940,7 @@ async function up$144(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$144(db) {
+async function down$146(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -3968,8 +3968,8 @@ async function down$144(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$143,
-	up: () => up$143
+	down: () => down$145,
+	up: () => up$145
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -4005,7 +4005,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$143(db) {
+async function up$145(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -4021,7 +4021,7 @@ async function up$143(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$143(db) {
+async function down$145(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -4040,8 +4040,8 @@ async function down$143(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$142,
-	up: () => up$142
+	down: () => down$144,
+	up: () => up$144
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -4054,7 +4054,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$142(db) {
+async function up$144(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -4063,14 +4063,14 @@ async function up$142(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$142(db) {
+async function down$144(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$141,
-	up: () => up$141
+	down: () => down$143,
+	up: () => up$143
 });
 /**
 * Cold-store chunk index (cold-store purge).
@@ -4102,7 +4102,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$141(db) {
+async function up$143(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -4129,14 +4129,14 @@ async function up$141(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$141(db) {
+async function down$143(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$140,
-	up: () => up$140
+	down: () => down$142,
+	up: () => up$142
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -4155,11 +4155,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$140(db) {
+async function up$142(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$140(db) {
+async function down$142(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -4198,8 +4198,8 @@ async function down$140(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$139,
-	up: () => up$139
+	down: () => down$141,
+	up: () => up$141
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -4223,7 +4223,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$139(db) {
+async function up$141(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -4241,14 +4241,14 @@ async function up$139(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$139(db) {
+async function down$141(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$138,
-	up: () => up$138
+	down: () => down$140,
+	up: () => up$140
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -4267,7 +4267,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$138(db) {
+async function up$140(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -4277,15 +4277,15 @@ async function up$138(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$138(db) {
+async function down$140(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$137,
-	up: () => up$137
+	down: () => down$139,
+	up: () => up$139
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -4319,7 +4319,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$137(db) {
+async function up$139(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -4350,7 +4350,7 @@ async function up$137(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$137(db) {
+async function down$139(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -4368,8 +4368,8 @@ async function down$137(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$136,
-	up: () => up$136
+	down: () => down$138,
+	up: () => up$138
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -4397,7 +4397,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$136(db) {
+async function up$138(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4522,7 +4522,7 @@ async function up$136(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$136(db) {
+async function down$138(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4547,8 +4547,8 @@ async function down$136(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$135,
-	up: () => up$135
+	down: () => down$137,
+	up: () => up$137
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -4561,7 +4561,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$135(db) {
+async function up$137(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4575,7 +4575,7 @@ async function up$135(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$135(db) {
+async function down$137(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -4583,8 +4583,8 @@ async function down$135(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$134,
-	up: () => up$134
+	down: () => down$136,
+	up: () => up$136
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -4623,17 +4623,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$134(db) {
+async function up$136(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$134(db) {
+async function down$136(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$133,
-	up: () => up$133
+	down: () => down$135,
+	up: () => up$135
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -4678,19 +4678,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$133(db) {
+async function up$135(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$133(db) {
+async function down$135(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$132,
-	up: () => up$132
+	down: () => down$134,
+	up: () => up$134
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -4713,7 +4713,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$132(db) {
+async function up$134(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -4734,15 +4734,15 @@ async function up$132(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$132(db) {
+async function down$134(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$131,
-	up: () => up$131
+	down: () => down$133,
+	up: () => up$133
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -4757,7 +4757,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$131(db) {
+async function up$133(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4771,7 +4771,7 @@ async function up$131(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$131(db) {
+async function down$133(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -4779,8 +4779,8 @@ async function down$131(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$130,
-	up: () => up$130
+	down: () => down$132,
+	up: () => up$132
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -4804,7 +4804,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$130(db) {
+async function up$132(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4835,14 +4835,14 @@ async function up$130(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$130(db) {
+async function down$132(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$129,
-	up: () => up$129
+	down: () => down$131,
+	up: () => up$131
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -4869,7 +4869,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$129(db) {
+async function up$131(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4919,7 +4919,7 @@ async function up$129(db) {
     `.execute(db);
 	}
 }
-async function down$129(db) {
+async function down$131(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -4927,8 +4927,8 @@ async function down$129(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$128,
-	up: () => up$128
+	down: () => down$130,
+	up: () => up$130
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -4952,7 +4952,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$128(db) {
+async function up$130(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4977,7 +4977,7 @@ async function up$128(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$128(db) {
+async function down$130(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -4989,8 +4989,8 @@ async function down$128(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$127,
-	up: () => up$127
+	down: () => down$129,
+	up: () => up$129
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -5006,7 +5006,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$127(db) {
+async function up$129(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -5022,7 +5022,7 @@ async function up$127(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$127(db) {
+async function down$129(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -5030,8 +5030,8 @@ async function down$127(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$126,
-	up: () => up$126
+	down: () => down$128,
+	up: () => up$128
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -5045,7 +5045,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$126(db) {
+async function up$128(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -5065,7 +5065,7 @@ async function up$126(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$126(db) {
+async function down$128(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -5076,8 +5076,8 @@ async function down$126(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$125,
-	up: () => up$125
+	down: () => down$127,
+	up: () => up$127
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -5086,7 +5086,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$125(db) {
+async function up$127(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -5096,7 +5096,7 @@ async function up$125(db) {
     ])))
   `.execute(db);
 }
-async function down$125(db) {
+async function down$127(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -5109,8 +5109,8 @@ async function down$125(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$124,
-	up: () => up$124
+	down: () => down$126,
+	up: () => up$126
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -5128,13 +5128,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$124(db) {
+async function up$126(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$124(db) {
+async function down$126(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -5142,8 +5142,8 @@ async function down$124(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$123,
-	up: () => up$123
+	down: () => down$125,
+	up: () => up$125
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -5172,7 +5172,7 @@ async function columnExists$14(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$123(db) {
+async function up$125(db) {
 	if (!await columnExists$14(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -5182,7 +5182,7 @@ async function up$123(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$123(db) {
+async function down$125(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -5193,8 +5193,8 @@ async function down$123(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$122,
-	up: () => up$122
+	down: () => down$124,
+	up: () => up$124
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -5208,7 +5208,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$122(db) {
+async function up$124(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5221,7 +5221,7 @@ async function up$122(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$122(db) {
+async function down$124(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -5229,8 +5229,8 @@ async function down$122(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$121,
-	up: () => up$121
+	down: () => down$123,
+	up: () => up$123
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -5241,14 +5241,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$121(db) {
+async function up$123(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$121(db) {
+async function down$123(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -5258,8 +5258,8 @@ async function down$121(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$120,
-	up: () => up$120
+	down: () => down$122,
+	up: () => up$122
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -5276,7 +5276,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$120(db) {
+async function up$122(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -5301,7 +5301,7 @@ async function up$120(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$120(db) {
+async function down$122(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -5309,8 +5309,8 @@ async function down$120(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$119,
-	up: () => up$119
+	down: () => down$121,
+	up: () => up$121
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -5322,7 +5322,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$119(db) {
+async function up$121(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5336,7 +5336,7 @@ async function up$119(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$119(db) {
+async function down$121(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -5344,8 +5344,8 @@ async function down$119(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$118,
-	up: () => up$118
+	down: () => down$120,
+	up: () => up$120
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -5362,7 +5362,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$118(db) {
+async function up$120(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -5382,7 +5382,7 @@ async function up$118(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$118(db) {
+async function down$120(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -5393,8 +5393,8 @@ async function down$118(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$117,
-	up: () => up$117
+	down: () => down$119,
+	up: () => up$119
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -5416,7 +5416,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$117(db) {
+async function up$119(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -5449,7 +5449,7 @@ async function up$117(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$117(db) {
+async function down$119(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -5459,8 +5459,8 @@ async function down$117(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$116,
-	up: () => up$116
+	down: () => down$118,
+	up: () => up$118
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -5469,7 +5469,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$116(db) {
+async function up$118(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -5479,14 +5479,14 @@ async function up$116(db) {
     )
   `.execute(db);
 }
-async function down$116(db) {
+async function down$118(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$115,
-	up: () => up$115
+	down: () => down$117,
+	up: () => up$117
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -5499,7 +5499,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$115(db) {
+async function up$117(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5525,14 +5525,14 @@ async function up$115(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$115(db) {
+async function down$117(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$114,
-	up: () => up$114
+	down: () => down$116,
+	up: () => up$116
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -5549,7 +5549,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$114(db) {
+async function up$116(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -5565,7 +5565,7 @@ async function up$114(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$114(db) {
+async function down$116(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -5584,8 +5584,8 @@ async function down$114(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$113,
-	up: () => up$113
+	down: () => down$115,
+	up: () => up$115
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -5597,7 +5597,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$113(db) {
+async function up$115(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5616,14 +5616,14 @@ async function up$113(db) {
     )
   `.execute(db);
 }
-async function down$113(db) {
+async function down$115(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$112,
-	up: () => up$112
+	down: () => down$114,
+	up: () => up$114
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -5640,7 +5640,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$112(db) {
+async function up$114(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5670,14 +5670,14 @@ async function up$112(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$112(db) {
+async function down$114(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$111,
-	up: () => up$111
+	down: () => down$113,
+	up: () => up$113
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -5704,7 +5704,7 @@ async function colExists$22(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$111(db) {
+async function up$113(db) {
 	if (!await colExists$22(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
 	if (!await colExists$22(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
 	if (!await colExists$22(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
@@ -5715,7 +5715,7 @@ async function up$111(db) {
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$111(db) {
+async function down$113(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -5725,8 +5725,8 @@ async function down$111(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$110,
-	up: () => up$110
+	down: () => down$112,
+	up: () => up$112
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -5756,7 +5756,7 @@ async function colExists$21(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$110(db) {
+async function up$112(db) {
 	if (!await colExists$21(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
 	if (!await colExists$21(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
 	if (!await colExists$21(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
@@ -5765,7 +5765,7 @@ async function up$110(db) {
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$110(db) {
+async function down$112(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -5774,8 +5774,8 @@ async function down$110(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$109,
-	up: () => up$109
+	down: () => down$111,
+	up: () => up$111
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -5801,19 +5801,19 @@ async function colExists$20(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$109(db) {
+async function up$111(db) {
 	if (!await colExists$20(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 	if (!await colExists$20(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$109(db) {
+async function down$111(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$108,
-	up: () => up$108
+	down: () => down$110,
+	up: () => up$110
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -5834,17 +5834,17 @@ async function colExists$19(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$108(db) {
+async function up$110(db) {
 	if (!await colExists$19(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$108(db) {
+async function down$110(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$107,
-	up: () => up$107
+	down: () => down$109,
+	up: () => up$109
 });
 /**
 * Add idempotent check-mode columns:
@@ -5871,13 +5871,13 @@ async function colExists$18(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$107(db) {
+async function up$109(db) {
 	if (!await colExists$18(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
 	if (!await colExists$18(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
 	if (!await colExists$18(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
 	if (!await colExists$18(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$107(db) {
+async function down$109(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -5886,8 +5886,8 @@ async function down$107(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$106,
-	up: () => up$106
+	down: () => down$108,
+	up: () => up$108
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -5901,18 +5901,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Existing data is preserved (additive column).
 */
-async function up$106(db) {
+async function up$108(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$106(db) {
+async function down$108(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$105,
-	up: () => up$105
+	down: () => down$107,
+	up: () => up$107
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -5927,18 +5927,18 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Existing data is preserved (additive nullable column).
 */
-async function up$105(db) {
+async function up$107(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$105(db) {
+async function down$107(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$104,
-	up: () => up$104
+	down: () => down$106,
+	up: () => up$106
 });
 /**
 * Migrate `execution_job_needs` from the binary `if_failed` policy to a
@@ -5973,7 +5973,7 @@ async function colExists$17(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
-async function up$104(db) {
+async function up$106(db) {
 	if (!await colExists$17(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
@@ -5992,7 +5992,7 @@ async function up$104(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$104(db) {
+async function down$106(db) {
 	if (!await colExists$17(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
@@ -6008,8 +6008,8 @@ async function down$104(db) {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$103,
-	up: () => up$103
+	down: () => down$105,
+	up: () => up$105
 });
 /**
 * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
@@ -6026,18 +6026,18 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$103(db) {
+async function up$105(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$103(db) {
+async function down$105(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$102,
-	up: () => up$102
+	down: () => down$104,
+	up: () => up$104
 });
 /**
 * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
@@ -6049,18 +6049,18 @@ var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$102(db) {
+async function up$104(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$102(db) {
+async function down$104(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$101,
-	up: () => up$101
+	down: () => down$103,
+	up: () => up$103
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -6075,18 +6075,18 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$101(db) {
+async function up$103(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down$101(db) {
+async function down$103(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/051_binding_host_pattern.ts
 var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$100,
-	up: () => up$100
+	down: () => down$102,
+	up: () => up$102
 });
 /**
 * Add a per-host dimension to environment secret bindings:
@@ -6102,7 +6102,7 @@ var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has the column / index is a no-op.
 * Additive — existing data is preserved.
 */
-async function up$100(db) {
+async function up$102(db) {
 	await sql`ALTER TABLE public.environment_bindings
     ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
@@ -6110,7 +6110,7 @@ async function up$100(db) {
 	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
     ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
 }
-async function down$100(db) {
+async function down$102(db) {
 	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
     DROP COLUMN IF EXISTS host_pattern`.execute(db);
@@ -6120,8 +6120,8 @@ async function down$100(db) {
 //#endregion
 //#region src/db/migrations/052_host_reach_metadata.ts
 var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$99,
-	up: () => up$99
+	down: () => down$101,
+	up: () => up$101
 });
 /**
 * Add pre-agent reach metadata to the host roster so a declared host (no agent
@@ -6138,14 +6138,14 @@ var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
 * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
 * so existing data is preserved.
 */
-async function up$99(db) {
+async function up$101(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS address text,
     ADD COLUMN IF NOT EXISTS ssh_user text,
     ADD COLUMN IF NOT EXISTS ssh_port integer,
     ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
 }
-async function down$99(db) {
+async function down$101(db) {
 	await sql`ALTER TABLE public.host_roster
     DROP COLUMN IF EXISTS address,
     DROP COLUMN IF EXISTS ssh_user,
@@ -6155,8 +6155,8 @@ async function down$99(db) {
 //#endregion
 //#region src/db/migrations/053_agent_token_single_use.ts
 var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$98,
-	up: () => up$98
+	down: () => down$100,
+	up: () => up$100
 });
 /**
 * Add a single-use marker to agent tokens for the bootstrap (init-runner)
@@ -6171,19 +6171,19 @@ var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$98(db) {
+async function up$100(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
 }
-async function down$98(db) {
+async function down$100(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS consumed_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/054_local_working_tree.ts
 var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$97,
-	up: () => up$97
+	down: () => down$99,
+	up: () => up$99
 });
 /**
 * Mark runs that executed an uploaded local working tree (`kici run remote`):
@@ -6196,19 +6196,19 @@ var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so existing
 * data is preserved.
 */
-async function up$97(db) {
+async function up$99(db) {
 	await sql`ALTER TABLE public.execution_runs
     ADD COLUMN IF NOT EXISTS local_working_tree boolean NOT NULL DEFAULT false`.execute(db);
 }
-async function down$97(db) {
+async function down$99(db) {
 	await sql`ALTER TABLE public.execution_runs
     DROP COLUMN IF EXISTS local_working_tree`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/055_agent_token_mandatory_labels.ts
 var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$96,
-	up: () => up$96
+	down: () => down$98,
+	up: () => up$98
 });
 /**
 * Add a token-bound mandatory-label taint to agent tokens:
@@ -6224,19 +6224,19 @@ var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$96(db) {
+async function up$98(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS mandatory_labels text`.execute(db);
 }
-async function down$96(db) {
+async function down$98(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS mandatory_labels`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/056_execution_jobs_environments.ts
 var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$95,
-	up: () => up$95
+	down: () => down$97,
+	up: () => up$97
 });
 /**
 * Add a per-job bound deployment-environment list to `execution_jobs`:
@@ -6251,19 +6251,19 @@ var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$95(db) {
+async function up$97(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS environments text`.execute(db);
 }
-async function down$95(db) {
+async function down$97(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS environments`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/057_step_concurrency.ts
 var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$94,
-	up: () => up$94
+	down: () => down$96,
+	up: () => up$96
 });
 /**
 * Add parallel step-group concurrency columns to `execution_steps`:
@@ -6286,19 +6286,19 @@ async function colExists$16(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$94(db) {
+async function up$96(db) {
 	if (!await colExists$16(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
 	if (!await colExists$16(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
 }
-async function down$94(db) {
+async function down$96(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/058_access_log_agent_label.ts
 var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$93,
-	up: () => up$93
+	down: () => down$95,
+	up: () => up$95
 });
 /**
 * Add `access_log.agent_label text` — the human-set name of the agent that
@@ -6318,17 +6318,17 @@ async function colExists$15(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$93(db) {
+async function up$95(db) {
 	if (!await colExists$15(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
 }
-async function down$93(db) {
+async function down$95(db) {
 	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/059_attestation_verdict.ts
 var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$92,
-	up: () => up$92
+	down: () => down$94,
+	up: () => up$94
 });
 /**
 * Add server-side verification verdict columns to `attestations`, plus the
@@ -6355,7 +6355,7 @@ async function colExists$14(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$92(db) {
+async function up$94(db) {
 	if (await colExists$14(db, "attestations", "verify_status")) return;
 	await sql`
     ALTER TABLE public.attestations
@@ -6368,7 +6368,7 @@ async function up$92(db) {
 	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
 	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
 }
-async function down$92(db) {
+async function down$94(db) {
 	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
@@ -6383,8 +6383,8 @@ async function down$92(db) {
 //#endregion
 //#region src/db/migrations/060_run_trigger_actor.ts
 var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$91,
-	up: () => up$91
+	down: () => down$93,
+	up: () => up$93
 });
 /**
 * Add the triggering-actor columns to `execution_runs`:
@@ -6412,12 +6412,12 @@ async function colExists$13(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$91(db) {
+async function up$93(db) {
 	if (!await colExists$13(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
 	if (!await colExists$13(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
 	if (!await colExists$13(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
 }
-async function down$91(db) {
+async function down$93(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
@@ -6425,8 +6425,8 @@ async function down$91(db) {
 //#endregion
 //#region src/db/migrations/061_execution_runs_environment_id.ts
 var _061_execution_runs_environment_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$90,
-	up: () => up$90
+	down: () => down$92,
+	up: () => up$92
 });
 /**
 * Add `environment_id` to `execution_runs` so environment run-history can be
@@ -6462,7 +6462,7 @@ async function colExists$12(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$90(db) {
+async function up$92(db) {
 	if (!await colExists$12(db, "execution_runs", "environment_id")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN environment_id uuid
@@ -6484,15 +6484,15 @@ async function up$90(db) {
              WHERE e2.type = 'fixed' AND e2.name = er.environment) = 1
   `.execute(db);
 }
-async function down$90(db) {
+async function down$92(db) {
 	await sql`DROP INDEX IF EXISTS idx_execution_runs_environment_id`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS environment_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/062_execution_runs_agent_label.ts
 var _062_execution_runs_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$89,
-	up: () => up$89
+	down: () => down$91,
+	up: () => up$91
 });
 /**
 * Add the agent-provenance columns to `execution_runs`:
@@ -6517,19 +6517,19 @@ async function colExists$11(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$89(db) {
+async function up$91(db) {
 	if (!await colExists$11(db, "execution_runs", "triggered_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN triggered_by_agent_label text`.execute(db);
 	if (!await colExists$11(db, "execution_runs", "cancelled_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN cancelled_by_agent_label text`.execute(db);
 }
-async function down$89(db) {
+async function down$91(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS triggered_by_agent_label`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelled_by_agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/063_access_log_agent_label_index.ts
 var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$88,
-	up: () => up$88
+	down: () => down$90,
+	up: () => up$90
 });
 /**
 * Index `access_log.agent_label` (column added by migration 058) so the
@@ -6537,17 +6537,17 @@ var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
 * the dashboard "agent name" filter) does an indexed exact-match lookup
 * instead of a scan. Idempotent.
 */
-async function up$88(db) {
+async function up$90(db) {
 	await sql`CREATE INDEX IF NOT EXISTS access_log_agent_label_idx ON public.access_log (agent_label)`.execute(db);
 }
-async function down$88(db) {
+async function down$90(db) {
 	await sql`DROP INDEX IF EXISTS access_log_agent_label_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/064_execution_jobs_skipped_environments.ts
 var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$87,
-	up: () => up$87
+	down: () => down$89,
+	up: () => up$89
 });
 /**
 * Add the test-run skipped-environment columns to `execution_jobs`:
@@ -6562,13 +6562,13 @@ var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportA
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$87(db) {
+async function up$89(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS skipped_environments text`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS env_warning text`.execute(db);
 }
-async function down$87(db) {
+async function down$89(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS skipped_environments`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
@@ -6577,8 +6577,8 @@ async function down$87(db) {
 //#endregion
 //#region src/db/migrations/065_pending_attestations.ts
 var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$86,
-	up: () => up$86
+	down: () => down$88,
+	up: () => up$88
 });
 /**
 * Add the `pending_attestations` deferred-attestation outbox and an idempotency
@@ -6598,7 +6598,7 @@ var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$86(db) {
+async function up$88(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -6637,15 +6637,15 @@ async function up$86(db) {
       ON public.attestations (run_id, job_id, subject_digest)
   `.execute(db);
 }
-async function down$86(db) {
+async function down$88(db) {
 	await sql`DROP INDEX IF EXISTS uq_attestations_run_job_subject`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.pending_attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/066_pending_attestations_rejected.ts
 var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$85,
-	up: () => up$85
+	down: () => down$87,
+	up: () => up$87
 });
 /**
 * Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
@@ -6656,14 +6656,14 @@ var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$85(db) {
+async function up$87(db) {
 	if (await columnExists$13(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
       ADD COLUMN rejected_at TIMESTAMPTZ
   `.execute(db);
 }
-async function down$85(db) {
+async function down$87(db) {
 	if (!await columnExists$13(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
@@ -6681,8 +6681,8 @@ async function columnExists$13(db, table, column) {
 //#endregion
 //#region src/db/migrations/067_environments_to_contexts.ts
 var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$84,
-	up: () => up$84
+	down: () => down$86,
+	up: () => up$86
 });
 /**
 * Rename the named-policy object from "environment" to "context" across the
@@ -6716,7 +6716,7 @@ var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
 * columns automatically (Postgres references them by identity, not name), so
 * only the one hand-named index above needs an explicit rename.
 */
-async function up$84(db) {
+async function up$86(db) {
 	await sql`ALTER TABLE public.environments RENAME TO contexts`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings RENAME TO context_bindings`.execute(db);
 	await sql`ALTER TABLE public.environment_variables RENAME TO context_variables`.execute(db);
@@ -6735,7 +6735,7 @@ async function up$84(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'context'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'context'`.execute(db);
 }
-async function down$84(db) {
+async function down$86(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'environment'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'environment'`.execute(db);
 	await sql`UPDATE public.held_runs SET trigger_source = 'environment' WHERE trigger_source = 'context'`.execute(db);
@@ -6757,8 +6757,8 @@ async function down$84(db) {
 //#endregion
 //#region src/db/migrations/068_request_idempotency.ts
 var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$83,
-	up: () => up$83
+	down: () => down$85,
+	up: () => up$85
 });
 /**
 * Add the `request_idempotency` claim table: a `request_id`-keyed record that
@@ -6773,12 +6773,12 @@ var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$83(db) {
+async function up$85(db) {
 	if (await tableExists$5(db, "request_idempotency")) return;
 	await db.schema.createTable("request_idempotency").addColumn("request_id", "text", (c) => c.primaryKey()).addColumn("new_run_id", "text", (c) => c.notNull()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("idx_request_idempotency_created_at").on("request_idempotency").column("created_at").execute();
 }
-async function down$83(db) {
+async function down$85(db) {
 	await db.schema.dropTable("request_idempotency").ifExists().execute();
 }
 async function tableExists$5(db, table) {
@@ -6792,8 +6792,8 @@ async function tableExists$5(db, table) {
 //#endregion
 //#region src/db/migrations/069_reroute_tunables.ts
 var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$82,
-	up: () => up$82
+	down: () => down$84,
+	up: () => up$84
 });
 /**
 * Add the three reroute-tunable columns to `org_settings` (all nullable):
@@ -6812,12 +6812,12 @@ var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: each column add is guarded on column existence, so a re-run on a
 * DB that already has a column is a no-op for that column.
 */
-async function up$82(db) {
+async function up$84(db) {
 	await addColumnIfMissing(db, "reroute_spawn_window_ms", "BIGINT");
 	await addColumnIfMissing(db, "reroute_ack_timeout_ms", "BIGINT");
 	await addColumnIfMissing(db, "reroute_max_hops", "INTEGER");
 }
-async function down$82(db) {
+async function down$84(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_spawn_window_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_ack_timeout_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_max_hops`.execute(db);
@@ -6836,8 +6836,8 @@ async function addColumnIfMissing(db, column, type) {
 //#endregion
 //#region src/db/migrations/070_execution_runs_failure_class.ts
 var _070_execution_runs_failure_class_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$81,
-	up: () => up$81
+	down: () => down$83,
+	up: () => up$83
 });
 /**
 * Add `execution_runs.failure_class` — the reason a terminal run failed
@@ -6858,17 +6858,17 @@ async function colExists$10(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$81(db) {
+async function up$83(db) {
 	if (!await colExists$10(db, "execution_runs", "failure_class")) await sql`ALTER TABLE public.execution_runs ADD COLUMN failure_class text`.execute(db);
 }
-async function down$81(db) {
+async function down$83(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS failure_class`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/071_batch_accumulation.ts
 var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$80,
-	up: () => up$80
+	down: () => down$82,
+	up: () => up$82
 });
 /**
 * Add the batch-accumulation tables that back the `workflows_failed_batch`
@@ -6892,7 +6892,7 @@ var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$80(db) {
+async function up$82(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -6937,15 +6937,15 @@ async function up$80(db) {
       ON public.batch_accumulation_items (window_id)
   `.execute(db);
 }
-async function down$80(db) {
+async function down$82(db) {
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_items`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_windows`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/072_dispatch_queue_run_id_index.ts
 var _072_dispatch_queue_run_id_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$79,
-	up: () => up$79
+	down: () => down$81,
+	up: () => up$81
 });
 /**
 * Add `idx_dispatch_queue_run_id` on `dispatch_queue (run_id)`.
@@ -6958,20 +6958,20 @@ var _072_dispatch_queue_run_id_index_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
 */
-async function up$79(db) {
+async function up$81(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_run_id
       ON public.dispatch_queue (run_id)
   `.execute(db);
 }
-async function down$79(db) {
+async function down$81(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_run_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/073_org_settings_ingest_concurrency.ts
 var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$78,
-	up: () => up$78
+	down: () => down$80,
+	up: () => up$80
 });
 /**
 * Add `org_settings.ingest_max_concurrency BIGINT` (nullable).
@@ -6982,7 +6982,7 @@ var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$78(db) {
+async function up$80(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6996,7 +6996,7 @@ async function up$78(db) {
       ADD COLUMN ingest_max_concurrency BIGINT
   `.execute(db);
 }
-async function down$78(db) {
+async function down$80(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS ingest_max_concurrency
   `.execute(db);
@@ -7004,8 +7004,8 @@ async function down$78(db) {
 //#endregion
 //#region src/db/migrations/074_normalize_zero_concurrency_limit.ts
 var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$77,
-	up: () => up$77
+	down: () => down$79,
+	up: () => up$79
 });
 /**
 * Normalize degenerate context concurrency limits. A `concurrency_limit` of 0
@@ -7016,15 +7016,15 @@ var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll(
 * Idempotent; down() is a no-op (a normalized 0 cannot — and should not — be
 * restored).
 */
-async function up$77(db) {
+async function up$79(db) {
 	await sql`UPDATE public.contexts SET concurrency_limit = NULL WHERE concurrency_limit <= 0`.execute(db);
 }
-async function down$77(_db) {}
+async function down$79(_db) {}
 //#endregion
 //#region src/db/migrations/075_ingest_overflow_buffer.ts
 var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$76,
-	up: () => up$76
+	down: () => down$78,
+	up: () => up$78
 });
 /**
 * Durable overflow buffer for shed webhook-ingest deliveries.
@@ -7038,7 +7038,7 @@ var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$76(db) {
+async function up$78(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -7071,14 +7071,14 @@ async function up$76(db) {
       ON public.ingest_overflow_buffer (delivery_id)
   `.execute(db);
 }
-async function down$76(db) {
+async function down$78(db) {
 	await sql`DROP TABLE IF EXISTS public.ingest_overflow_buffer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/076_artifacts.ts
 var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$75,
-	up: () => up$75
+	down: () => down$77,
+	up: () => up$77
 });
 /**
 * Add the `artifacts` table for user-facing build artifacts and the per-org
@@ -7095,7 +7095,7 @@ var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table / columns is a no-op.
 */
-async function up$75(db) {
+async function up$77(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -7131,7 +7131,7 @@ async function up$75(db) {
       ADD COLUMN IF NOT EXISTS artifact_ttl_ms BIGINT
   `.execute(db);
 }
-async function down$75(db) {
+async function down$77(db) {
 	await sql`DROP TABLE IF EXISTS public.artifacts`.execute(db);
 	await sql`
     ALTER TABLE public.org_settings
@@ -7142,8 +7142,8 @@ async function down$75(db) {
 //#endregion
 //#region src/db/migrations/077_backup_runs.ts
 var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$74,
-	up: () => up$74
+	down: () => down$76,
+	up: () => up$76
 });
 /**
 * Add the `backup_runs` table: one row per successful `kici-admin db backup`,
@@ -7154,12 +7154,12 @@ var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$74(db) {
+async function up$76(db) {
 	if (await tableExists$4(db, "backup_runs")) return;
 	await db.schema.createTable("backup_runs").addColumn("id", "bigserial", (c) => c.primaryKey()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("dump_path", "text", (c) => c.notNull()).addColumn("byte_size", "bigint", (c) => c.notNull()).addColumn("secret_key_version", "integer").addColumn("pg_server_version", "text", (c) => c.notNull()).addColumn("migrations_hash", "text", (c) => c.notNull()).addColumn("hostname", "text", (c) => c.notNull()).execute();
 	await db.schema.createIndex("idx_backup_runs_created_at").on("backup_runs").column("created_at").execute();
 }
-async function down$74(db) {
+async function down$76(db) {
 	await db.schema.dropTable("backup_runs").ifExists().execute();
 }
 async function tableExists$4(db, table) {
@@ -7173,8 +7173,8 @@ async function tableExists$4(db, table) {
 //#endregion
 //#region src/db/migrations/078_org_settings_backup_staleness.ts
 var _078_org_settings_backup_staleness_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$73,
-	up: () => up$73
+	down: () => down$75,
+	up: () => up$75
 });
 /**
 * Add the nullable `org_settings.backup_staleness_warn_hours INTEGER` column:
@@ -7184,7 +7184,7 @@ var _078_org_settings_backup_staleness_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$73(db) {
+async function up$75(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7198,7 +7198,7 @@ async function up$73(db) {
       ADD COLUMN backup_staleness_warn_hours INTEGER
   `.execute(db);
 }
-async function down$73(db) {
+async function down$75(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS backup_staleness_warn_hours
   `.execute(db);
@@ -7206,8 +7206,8 @@ async function down$73(db) {
 //#endregion
 //#region src/db/migrations/079_org_settings_scaler_spawn_timeout.ts
 var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$72,
-	up: () => up$72
+	down: () => down$74,
+	up: () => up$74
 });
 /**
 * Add `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable).
@@ -7219,7 +7219,7 @@ var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$72(db) {
+async function up$74(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7233,7 +7233,7 @@ async function up$72(db) {
       ADD COLUMN scaler_spawn_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$72(db) {
+async function down$74(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS scaler_spawn_timeout_ms
   `.execute(db);
@@ -7241,8 +7241,8 @@ async function down$72(db) {
 //#endregion
 //#region src/db/migrations/080_cluster_settings.ts
 var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$71,
-	up: () => up$71
+	down: () => down$73,
+	up: () => up$73
 });
 /**
 * Create `cluster_settings`: a single-row (id='default') table of fleet-wide
@@ -7257,7 +7257,7 @@ var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$71(db) {
+async function up$73(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -7281,14 +7281,14 @@ async function up$71(db) {
     )
   `.execute(db);
 }
-async function down$71(db) {
+async function down$73(db) {
 	await sql`DROP TABLE IF EXISTS public.cluster_settings`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/081_org_settings_queue_timeout.ts
 var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$70,
-	up: () => up$70
+	down: () => down$72,
+	up: () => up$72
 });
 /**
 * Add `org_settings.queue_timeout_ms BIGINT` (nullable).
@@ -7305,7 +7305,7 @@ var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$70(db) {
+async function up$72(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7319,7 +7319,7 @@ async function up$70(db) {
       ADD COLUMN queue_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$70(db) {
+async function down$72(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS queue_timeout_ms
   `.execute(db);
@@ -7327,8 +7327,8 @@ async function down$70(db) {
 //#endregion
 //#region src/db/migrations/082_host_s3_reachable.ts
 var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$69,
-	up: () => up$69
+	down: () => down$71,
+	up: () => up$71
 });
 /**
 * Add `host_roster.s3_reachable BOOLEAN` (nullable).
@@ -7342,7 +7342,7 @@ var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$69(db) {
+async function up$71(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7356,7 +7356,7 @@ async function up$69(db) {
       ADD COLUMN s3_reachable BOOLEAN
   `.execute(db);
 }
-async function down$69(db) {
+async function down$71(db) {
 	await sql`
     ALTER TABLE public.host_roster DROP COLUMN IF EXISTS s3_reachable
   `.execute(db);
@@ -7364,8 +7364,8 @@ async function down$69(db) {
 //#endregion
 //#region src/db/migrations/083_org_settings_artifact_caps.ts
 var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$68,
-	up: () => up$68
+	down: () => down$70,
+	up: () => up$70
 });
 /**
 * Add `org_settings.artifact_max_bytes` + `artifact_max_per_run` (both nullable
@@ -7381,7 +7381,7 @@ var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has a
 * column is a no-op.
 */
-async function up$68(db) {
+async function up$70(db) {
 	for (const col of ["artifact_max_bytes", "artifact_max_per_run"]) {
 		if ((await sql`
       SELECT EXISTS (
@@ -7394,15 +7394,15 @@ async function up$68(db) {
 		await sql`ALTER TABLE public.org_settings ADD COLUMN ${sql.ref(col)} BIGINT`.execute(db);
 	}
 }
-async function down$68(db) {
+async function down$70(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_bytes`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_per_run`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/084_orchestrator_signing_keys.ts
 var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$67,
-	up: () => up$67
+	down: () => down$69,
+	up: () => up$69
 });
 /**
 * Add the `orchestrator_signing_keys` table: the cluster-scoped, long-lived
@@ -7420,12 +7420,12 @@ var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$67(db) {
+async function up$69(db) {
 	if (await tableExists$3(db, "orchestrator_signing_keys")) return;
 	await db.schema.createTable("orchestrator_signing_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_jwk", "text").addColumn("key_version", "integer", (c) => c.notNull().defaultTo(1)).addColumn("alg", "text", (c) => c.notNull()).addColumn("signer_kind", "text", (c) => c.notNull()).addColumn("key_ref", "text").addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("retired_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_orch_signing_keys_status").on("orchestrator_signing_keys").column("status").execute();
 }
-async function down$67(db) {
+async function down$69(db) {
 	await db.schema.dropTable("orchestrator_signing_keys").ifExists().execute();
 }
 async function tableExists$3(db, table) {
@@ -7439,8 +7439,8 @@ async function tableExists$3(db, table) {
 //#endregion
 //#region src/db/migrations/085_cluster_settings_reroute_flap_grace_ms.ts
 var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$66,
-	up: () => up$66
+	down: () => down$68,
+	up: () => up$68
 });
 /**
 * Add `cluster_settings.reroute_flap_grace_ms` (nullable BIGINT).
@@ -7450,7 +7450,7 @@ var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __expo
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$66(db) {
+async function up$68(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7461,14 +7461,14 @@ async function up$66(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN reroute_flap_grace_ms BIGINT`.execute(db);
 }
-async function down$66(db) {
+async function down$68(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS reroute_flap_grace_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/086_cluster_settings_max_fanout_hosts.ts
 var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$65,
-	up: () => up$65
+	down: () => down$67,
+	up: () => up$67
 });
 /**
 * Add `cluster_settings.max_fanout_hosts` (nullable INTEGER).
@@ -7478,7 +7478,7 @@ var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$65(db) {
+async function up$67(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7489,14 +7489,14 @@ async function up$65(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN max_fanout_hosts INTEGER`.execute(db);
 }
-async function down$65(db) {
+async function down$67(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS max_fanout_hosts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/087_cluster_settings_event_router_rate_limit.ts
 var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$64,
-	up: () => up$64
+	down: () => down$66,
+	up: () => up$66
 });
 /**
 * Add `cluster_settings.event_router_rate_limit_per_workflow_per_minute` (nullable INTEGER).
@@ -7506,7 +7506,7 @@ var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __ex
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$64(db) {
+async function up$66(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7517,14 +7517,14 @@ async function up$64(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN event_router_rate_limit_per_workflow_per_minute INTEGER`.execute(db);
 }
-async function down$64(db) {
+async function down$66(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS event_router_rate_limit_per_workflow_per_minute`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/088_cluster_settings_cache_max_tarball_bytes.ts
 var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$63,
-	up: () => up$63
+	down: () => down$65,
+	up: () => up$65
 });
 /**
 * Add `cluster_settings.cache_max_tarball_bytes` (nullable BIGINT).
@@ -7534,7 +7534,7 @@ var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __ex
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$63(db) {
+async function up$65(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7545,14 +7545,14 @@ async function up$63(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_max_tarball_bytes BIGINT`.execute(db);
 }
-async function down$63(db) {
+async function down$65(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_max_tarball_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/089_cluster_settings_cache_ttl_days.ts
 var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$62,
-	up: () => up$62
+	down: () => down$64,
+	up: () => up$64
 });
 /**
 * Add `cluster_settings.cache_ttl_days` (nullable INTEGER).
@@ -7562,7 +7562,7 @@ var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$62(db) {
+async function up$64(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7573,14 +7573,14 @@ async function up$62(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_ttl_days INTEGER`.execute(db);
 }
-async function down$62(db) {
+async function down$64(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_ttl_days`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/090_cluster_settings_concurrency_wait_timeout_ms.ts
 var _090_cluster_settings_concurrency_wait_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$61,
-	up: () => up$61
+	down: () => down$63,
+	up: () => up$63
 });
 /**
 * Add `cluster_settings.concurrency_wait_timeout_ms` (nullable BIGINT).
@@ -7590,7 +7590,7 @@ var _090_cluster_settings_concurrency_wait_timeout_ms_exports = /* @__PURE__ */
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$61(db) {
+async function up$63(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7601,14 +7601,14 @@ async function up$61(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN concurrency_wait_timeout_ms BIGINT`.execute(db);
 }
-async function down$61(db) {
+async function down$63(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS concurrency_wait_timeout_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/091_cluster_settings_agent_token_ttl_ms.ts
 var _091_cluster_settings_agent_token_ttl_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$60,
-	up: () => up$60
+	down: () => down$62,
+	up: () => up$62
 });
 /**
 * Add `cluster_settings.agent_token_ttl_ms` (nullable BIGINT).
@@ -7618,7 +7618,7 @@ var _091_cluster_settings_agent_token_ttl_ms_exports = /* @__PURE__ */ __exportA
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$60(db) {
+async function up$62(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7629,14 +7629,14 @@ async function up$60(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN agent_token_ttl_ms BIGINT`.execute(db);
 }
-async function down$60(db) {
+async function down$62(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS agent_token_ttl_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/092_cluster_settings_version.ts
 var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$59,
-	up: () => up$59
+	down: () => down$61,
+	up: () => up$61
 });
 /**
 * Add `cluster_settings.version` (monotonic BIGINT, bumped on each settings
@@ -7650,7 +7650,7 @@ var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$59(db) {
+async function up$61(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7661,14 +7661,14 @@ async function up$59(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN version BIGINT NOT NULL DEFAULT 0`.execute(db);
 }
-async function down$59(db) {
+async function down$61(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS version`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/093_org_settings_sandbox_allowlist.ts
 var _093_org_settings_sandbox_allowlist_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$58,
-	up: () => up$58
+	down: () => down$60,
+	up: () => up$60
 });
 /**
 * Add the per-org container-sandbox escape-hatch allow-list to `org_settings`:
@@ -7696,7 +7696,7 @@ async function columnExists$12(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$58(db) {
+async function up$60(db) {
 	if (!await columnExists$12(db, "sandbox_allowed_capabilities")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN sandbox_allowed_capabilities TEXT[]
@@ -7706,7 +7706,7 @@ async function up$58(db) {
         ADD COLUMN sandbox_allow_host_network BOOLEAN
     `.execute(db);
 }
-async function down$58(db) {
+async function down$60(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS sandbox_allowed_capabilities
   `.execute(db);
@@ -7717,8 +7717,8 @@ async function down$58(db) {
 //#endregion
 //#region src/db/migrations/094_dashboard_encryption_keys.ts
 var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$57,
-	up: () => up$57
+	down: () => down$59,
+	up: () => up$59
 });
 /**
 * Add the `dashboard_encryption_keys` table: the cluster-scoped, long-lived
@@ -7737,12 +7737,12 @@ var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$57(db) {
+async function up$59(db) {
 	if (await tableExists$2(db, "dashboard_encryption_keys")) return;
 	await db.schema.createTable("dashboard_encryption_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_key", "text", (c) => c.notNull()).addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_dashboard_encryption_keys_status").on("dashboard_encryption_keys").column("status").execute();
 }
-async function down$57(db) {
+async function down$59(db) {
 	await db.schema.dropTable("dashboard_encryption_keys").ifExists().execute();
 }
 async function tableExists$2(db, table) {
@@ -7756,8 +7756,8 @@ async function tableExists$2(db, table) {
 //#endregion
 //#region src/db/migrations/095_dashboard_write_policy_tristate.ts
 var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$56,
-	up: () => up$56
+	down: () => down$58,
+	up: () => up$58
 });
 /**
 * Migrate stored `org_settings.dashboard_write_policy` JSONB from the legacy
@@ -7775,7 +7775,7 @@ var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
 * Pure SQL rewrite: for each row, rebuild the object keeping only non-`true`
 * entries and mapping `false` → `'disabled'`, leaving existing string values.
 */
-async function up$56(db) {
+async function up$58(db) {
 	await sql`
     UPDATE org_settings
        SET dashboard_write_policy = COALESCE(
@@ -7802,12 +7802,12 @@ async function up$56(db) {
        )
   `.execute(db);
 }
-async function down$56() {}
+async function down$58() {}
 //#endregion
 //#region src/db/migrations/096_multi_schedule_cron_last_fired.ts
 var _096_multi_schedule_cron_last_fired_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$55,
-	up: () => up$55
+	down: () => down$57,
+	up: () => up$57
 });
 /**
 * Track cron last-fired per (registration, schedule) instead of per
@@ -7842,7 +7842,7 @@ async function primaryKeyColumns(db) {
      ORDER BY a.attnum
   `.execute(db)).rows.map((row) => row.attname);
 }
-async function up$55(db) {
+async function up$57(db) {
 	if (!await columnExists$11(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired ADD COLUMN schedule_key text`.execute(db);
 	await sql`
     UPDATE public.cron_last_fired clf
@@ -7869,7 +7869,7 @@ async function up$55(db) {
     `.execute(db);
 	}
 }
-async function down$55(db) {
+async function down$57(db) {
 	await sql`
     DELETE FROM public.cron_last_fired a
       USING public.cron_last_fired b
@@ -7886,8 +7886,8 @@ async function down$55(db) {
 //#endregion
 //#region src/db/migrations/097_execution_runs_pr_number.ts
 var _097_execution_runs_pr_number_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$54,
-	up: () => up$54
+	down: () => down$56,
+	up: () => up$56
 });
 /**
 * Add `pr_number INTEGER NULL` to `execution_runs`.
@@ -7910,13 +7910,13 @@ async function columnExists$10(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$54(db) {
+async function up$56(db) {
 	if (!await columnExists$10(db, "pr_number")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN pr_number INTEGER
     `.execute(db);
 }
-async function down$54(db) {
+async function down$56(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS pr_number
   `.execute(db);
@@ -7924,8 +7924,8 @@ async function down$54(db) {
 //#endregion
 //#region src/db/migrations/098_execution_runs_customer_id.ts
 var _098_execution_runs_customer_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$53,
-	up: () => up$53
+	down: () => down$55,
+	up: () => up$55
 });
 /**
 * Denormalize the owning org onto `execution_runs` so the concurrency-gate
@@ -7953,7 +7953,7 @@ async function columnExists$9(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$53(db) {
+async function up$55(db) {
 	if (!await columnExists$9(db, "customer_id")) {
 		await sql`
       ALTER TABLE public.execution_runs
@@ -7977,7 +7977,7 @@ async function up$53(db) {
       ON public.execution_runs (customer_id, context)
   `.execute(db);
 }
-async function down$53(db) {
+async function down$55(db) {
 	await sql`DROP INDEX IF EXISTS execution_runs_customer_id_context_idx`.execute(db);
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS customer_id
@@ -7986,8 +7986,8 @@ async function down$53(db) {
 //#endregion
 //#region src/db/migrations/099_cluster_settings_dashboard_verified_issuer.ts
 var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$52,
-	up: () => up$52
+	down: () => down$54,
+	up: () => up$54
 });
 /**
 * Add `cluster_settings.dashboard_verified_issuer` (nullable text).
@@ -8006,7 +8006,7 @@ var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$52(db) {
+async function up$54(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8017,14 +8017,14 @@ async function up$52(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN dashboard_verified_issuer TEXT`.execute(db);
 }
-async function down$52(db) {
+async function down$54(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS dashboard_verified_issuer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/100_held_runs_hold_type_vocabulary.ts
 var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$51,
-	up: () => up$51
+	down: () => down$53,
+	up: () => up$53
 });
 /**
 * Realign `held_runs.hold_type` onto the engine's `HoldType` vocabulary.
@@ -8043,7 +8043,7 @@ var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a second run matches no rows.
 */
-async function up$51(db) {
+async function up$53(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'reviewer' WHERE hold_type = 'approval'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'timer' WHERE hold_type = 'wait_timer'`.execute(db);
 }
@@ -8057,15 +8057,15 @@ async function up$51(db) {
 * `wait_timer` alone, so leaving those rows spelled `timer` would strand them
 * in the expire-and-fail path.
 */
-async function down$51(db) {
+async function down$53(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'approval' WHERE hold_type = 'reviewer'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'wait_timer' WHERE hold_type = 'timer'`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/101_contexts_hold_expiry_drop_default.ts
 var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$50,
-	up: () => up$50
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * Give the context hold expiry a single default, and retire the stored zeroes.
@@ -8086,7 +8086,7 @@ var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll
 * Idempotent: dropping an absent default is a no-op and the UPDATE matches no
 * rows on a second run.
 */
-async function up$50(db) {
+async function up$52(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds DROP DEFAULT`.execute(db);
 	await sql`UPDATE public.contexts SET hold_expiry_seconds = NULL WHERE hold_expiry_seconds = 0`.execute(db);
 }
@@ -8098,14 +8098,14 @@ async function up$50(db) {
 * back to `0` would resume cancelling every hold on its context — so a
 * rollback keeps them on the fallback rather than re-breaking them.
 */
-async function down$50(db) {
+async function down$52(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds SET DEFAULT 86400`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/102_dispatch_queue_agent_id.ts
 var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Add `dispatch_queue.agent_id` (nullable text).
@@ -8123,7 +8123,7 @@ var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$49(db) {
+async function up$51(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8134,14 +8134,14 @@ async function up$49(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.dispatch_queue ADD COLUMN agent_id TEXT`.execute(db);
 }
-async function down$49(db) {
+async function down$51(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS agent_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/103_cluster_settings_ownership_db_check_timeout_ms.ts
 var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Add `cluster_settings.ownership_db_check_timeout_ms` (nullable bigint).
@@ -8159,7 +8159,7 @@ var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ *
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$48(db) {
+async function up$50(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8170,14 +8170,14 @@ async function up$48(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN ownership_db_check_timeout_ms BIGINT`.execute(db);
 }
-async function down$48(db) {
+async function down$50(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ownership_db_check_timeout_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/104_check_run_terminal_sent.ts
 var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Add `check_run_tracking.terminal_sent_at` (nullable timestamptz).
@@ -8197,7 +8197,7 @@ var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$47(db) {
+async function up$49(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8208,14 +8208,14 @@ async function up$47(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.check_run_tracking ADD COLUMN terminal_sent_at TIMESTAMPTZ`.execute(db);
 }
-async function down$47(db) {
+async function down$49(db) {
 	await sql`ALTER TABLE public.check_run_tracking DROP COLUMN IF EXISTS terminal_sent_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/105_org_trust_policy.ts
 var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
@@ -8232,7 +8232,7 @@ var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
 */
-async function up$46(db) {
+async function up$48(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.org_trust_policy (
       customer_id                TEXT PRIMARY KEY,
@@ -8245,14 +8245,14 @@ async function up$46(db) {
     )
   `.execute(db);
 }
-async function down$46(db) {
+async function down$48(db) {
 	await sql`DROP TABLE IF EXISTS public.org_trust_policy`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.ts
 var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Add `cluster_settings.check_run_tracking_ttl_days` (nullable integer).
@@ -8268,7 +8268,7 @@ var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */
 * Idempotent: guarded on column existence; a re-run on a database that already
 * has the column is a no-op.
 */
-async function up$45(db) {
+async function up$47(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8279,14 +8279,14 @@ async function up$45(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN check_run_tracking_ttl_days INTEGER`.execute(db);
 }
-async function down$45(db) {
+async function down$47(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS check_run_tracking_ttl_days`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/107_check_run_tracking_updated_at_index.ts
 var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
@@ -8307,20 +8307,20 @@ var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
 */
-async function up$44(db) {
+async function up$46(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_check_run_tracking_updated_at
       ON public.check_run_tracking (updated_at)
   `.execute(db);
 }
-async function down$44(db) {
+async function down$46(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_check_run_tracking_updated_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/108_unroutable_fast_fail.ts
 var _108_unroutable_fast_fail_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Fast-fail support for jobs nothing in the fleet can run.
@@ -8351,12 +8351,12 @@ async function columnExists$8(db, table, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$43(db) {
+async function up$45(db) {
 	if (!await columnExists$8(db, "cluster_settings", "unroutable_grace_ms")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN unroutable_grace_ms INTEGER`.execute(db);
 	if (!await columnExists$8(db, "dispatch_queue", "unroutable_since")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN unroutable_since TIMESTAMPTZ`.execute(db);
 	if (!await columnExists$8(db, "execution_jobs", "routing_reason")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN routing_reason TEXT`.execute(db);
 }
-async function down$43(db) {
+async function down$45(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS routing_reason`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS unroutable_since`.execute(db);
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS unroutable_grace_ms`.execute(db);
@@ -8364,8 +8364,8 @@ async function down$43(db) {
 //#endregion
 //#region src/db/migrations/109_cluster_settings_cache_knobs.ts
 var _109_cluster_settings_cache_knobs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * Cluster-global cache tunables for the lock-file cache and the Tier-1
@@ -8400,17 +8400,17 @@ const COLUMNS$6 = [
 	"content_cache_max_bytes",
 	"content_cache_ttl_ms"
 ];
-async function up$42(db) {
+async function up$44(db) {
 	for (const column of COLUMNS$6) if (!await columnExists$7(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$42(db) {
+async function down$44(db) {
 	for (const column of COLUMNS$6) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/110_cluster_settings_global_eval_knobs.ts
 var _110_cluster_settings_global_eval_knobs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * Cluster-global tunables for the Tier-2 global eval round — the pre-run job
@@ -8443,17 +8443,17 @@ const COLUMNS$5 = [
 	"global_eval_candidate_timeout_ms",
 	"global_eval_cache_max"
 ];
-async function up$41(db) {
+async function up$43(db) {
 	for (const column of COLUMNS$5) if (!await columnExists$6(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$41(db) {
+async function down$43(db) {
 	for (const column of COLUMNS$5) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/111_cluster_settings_global_eval_wait.ts
 var _111_cluster_settings_global_eval_wait_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Cluster-global ceiling on how long webhook processing waits for a Tier-2
@@ -8481,17 +8481,17 @@ async function columnExists$5(db, table, column) {
   `.execute(db)).rows[0]?.exists === true;
 }
 const COLUMNS$4 = ["global_eval_wait_timeout_ms"];
-async function up$40(db) {
+async function up$42(db) {
 	for (const column of COLUMNS$4) if (!await columnExists$5(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$40(db) {
+async function down$42(db) {
 	for (const column of COLUMNS$4) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/112_execution_runs_workflow_repo.ts
 var _112_execution_runs_workflow_repo_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Record which repository DEFINED the workflow a run executed.
@@ -8525,13 +8525,13 @@ async function colExists$9(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$39(db) {
+async function up$41(db) {
 	if (!await colExists$9(db, "execution_runs", "workflow_repo_identifier")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN workflow_repo_identifier text
     `.execute(db);
 }
-async function down$39(db) {
+async function down$41(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_repo_identifier
   `.execute(db);
@@ -8539,8 +8539,8 @@ async function down$39(db) {
 //#endregion
 //#region src/db/migrations/113_execution_runs_workflow_repo_index.ts
 var _113_execution_runs_workflow_repo_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Add the partial index `idx_execution_runs_workflow_repo` on
@@ -8568,21 +8568,21 @@ var _113_execution_runs_workflow_repo_index_exports = /* @__PURE__ */ __exportAl
 *
 * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
 */
-async function up$38(db) {
+async function up$40(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_execution_runs_workflow_repo
       ON public.execution_runs (workflow_repo_identifier)
       WHERE workflow_repo_identifier IS NOT NULL
   `.execute(db);
 }
-async function down$38(db) {
+async function down$40(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_runs_workflow_repo`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/114_ingest_queue_claim.ts
 var _114_ingest_queue_claim_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Claim bookkeeping for the durable ingest queue.
@@ -8613,13 +8613,13 @@ async function columnExists$4(db, table, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$37(db) {
+async function up$39(db) {
 	if (!await columnExists$4(db, "ingest_overflow_buffer", "claimed_at")) await sql`ALTER TABLE public.ingest_overflow_buffer ADD COLUMN claimed_at TIMESTAMPTZ`.execute(db);
 	if (!await columnExists$4(db, "cluster_settings", "ingest_overflow_claim_timeout_ms")) await sql`
       ALTER TABLE public.cluster_settings ADD COLUMN ingest_overflow_claim_timeout_ms INTEGER
     `.execute(db);
 }
-async function down$37(db) {
+async function down$39(db) {
 	await sql`
     ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ingest_overflow_claim_timeout_ms
   `.execute(db);
@@ -8630,8 +8630,8 @@ async function down$37(db) {
 //#endregion
 //#region src/db/migrations/115_global_workflows_cluster_switch.ts
 var _115_global_workflows_cluster_switch_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Move the global-workflows master switch from `org_settings` to
@@ -8669,7 +8669,7 @@ async function columnExists$3(db, table, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$36(db) {
+async function up$38(db) {
 	if (!await columnExists$3(db, "cluster_settings", "global_workflows_enabled")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN global_workflows_enabled BOOLEAN`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS global_workflows_enabled`.execute(db);
 }
@@ -8678,7 +8678,7 @@ async function up$36(db) {
 * cannot recover the per-org values the up-migration dropped — they are gone —
 * so every org comes back at the opt-in default.
 */
-async function down$36(db) {
+async function down$38(db) {
 	if (!await columnExists$3(db, "org_settings", "global_workflows_enabled")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN global_workflows_enabled BOOLEAN NOT NULL DEFAULT false
@@ -8688,20 +8688,20 @@ async function down$36(db) {
 //#endregion
 //#region src/db/migrations/116_org_plan_headroom.ts
 var _116_org_plan_headroom_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$37,
+	up: () => up$37
 });
-async function up$35(db) {
+async function up$37(db) {
 	await db.schema.createTable("org_plan_headroom").ifNotExists().addColumn("id", "varchar(16)", (col) => col.primaryKey()).addColumn("max_worker_peers", "integer", (col) => col.notNull()).addColumn("org_limit", "integer", (col) => col.notNull()).addColumn("org_total", "integer", (col) => col.notNull()).addColumn("evict_excess", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("updated_at", sql`timestamptz`, (col) => col.notNull()).execute();
 }
-async function down$35(db) {
+async function down$37(db) {
 	await db.schema.dropTable("org_plan_headroom").ifExists().execute();
 }
 //#endregion
 //#region src/db/migrations/117_invoke_gate_proxy_jobs.ts
 var _117_invoke_gate_proxy_jobs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Proxy-job + summon-correlation columns for the invoke gate.
@@ -8732,7 +8732,7 @@ async function colExists$8(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$34(db) {
+async function up$36(db) {
 	if (!await colExists$8(db, "execution_jobs", "job_kind")) await sql`
       ALTER TABLE public.execution_jobs
         ADD COLUMN job_kind text NOT NULL DEFAULT 'standard'
@@ -8750,7 +8750,7 @@ async function up$34(db) {
         ADD COLUMN summoned_by_proxy_job text
     `.execute(db);
 }
-async function down$34(db) {
+async function down$36(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS job_kind`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS summoned_run_id`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS summoned_by_run_id`.execute(db);
@@ -8759,8 +8759,8 @@ async function down$34(db) {
 //#endregion
 //#region src/db/migrations/118_invoke_gate_scheduling.ts
 var _118_invoke_gate_scheduling_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Scheduling columns for the invoke gate: the pieces the orchestrator needs to
@@ -8792,7 +8792,7 @@ async function colExists$7(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$33(db) {
+async function up$35(db) {
 	if (!await colExists$7(db, "execution_jobs", "timeout_ms")) await sql`
       ALTER TABLE public.execution_jobs
         ADD COLUMN timeout_ms integer
@@ -8806,7 +8806,7 @@ async function up$33(db) {
         ADD COLUMN invoke_config text
     `.execute(db);
 }
-async function down$33(db) {
+async function down$35(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS timeout_ms`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS chain_depth`.execute(db);
 	await sql`ALTER TABLE public.pending_job_contexts DROP COLUMN IF EXISTS invoke_config`.execute(db);
@@ -8814,8 +8814,8 @@ async function down$33(db) {
 //#endregion
 //#region src/db/migrations/119_scaler_ha_ownership.ts
 var _119_scaler_ha_ownership_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * HA ownership for event-scaler provisions.
@@ -8862,7 +8862,7 @@ const SPAWNING_COLUMNS = [
 	["roles", "JSONB"],
 	["backend_type", "TEXT"]
 ];
-async function up$32(db) {
+async function up$34(db) {
 	if (!await tableExists$1(db, "scaler_pending_claims")) {
 		await sql`
       CREATE TABLE public.scaler_pending_claims (
@@ -8908,7 +8908,7 @@ async function up$32(db) {
       ON public.scaler_reservations (owner_instance_id)
   `.execute(db);
 }
-async function down$32(db) {
+async function down$34(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_pending_claims`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_scaler_spawning_agents_scaler_name`.execute(db);
 	for (const [name] of SPAWNING_COLUMNS) await sql`
@@ -8921,8 +8921,8 @@ async function down$32(db) {
 //#endregion
 //#region src/db/migrations/120_cluster_settings_scaler_reaper.ts
 var _120_cluster_settings_scaler_reaper_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Cluster-global tunables for the leader-gated event-scaler provision reaper.
@@ -8964,17 +8964,17 @@ const COLUMNS$3 = [
 	"scaler_reap_reattempt_interval_ms",
 	"scaler_claim_retention_ms"
 ];
-async function up$31(db) {
+async function up$33(db) {
 	for (const column of COLUMNS$3) if (!await columnExists$2(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$31(db) {
+async function down$33(db) {
 	for (const column of COLUMNS$3) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/121_org_settings_allow_untrusted_dockerfile_builds.ts
 var _121_org_settings_allow_untrusted_dockerfile_builds_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Add `org_settings.allow_untrusted_dockerfile_builds boolean NOT NULL DEFAULT false`.
@@ -8991,7 +8991,7 @@ var _121_org_settings_allow_untrusted_dockerfile_builds_exports = /* @__PURE__ *
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$30(db) {
+async function up$32(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9005,7 +9005,7 @@ async function up$30(db) {
       ADD COLUMN allow_untrusted_dockerfile_builds boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$30(db) {
+async function down$32(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_untrusted_dockerfile_builds
   `.execute(db);
@@ -9013,8 +9013,8 @@ async function down$30(db) {
 //#endregion
 //#region src/db/migrations/122_host_roster_scaler_managed.ts
 var _122_host_roster_scaler_managed_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add `host_roster.scaler_managed boolean NOT NULL DEFAULT false`.
@@ -9037,7 +9037,7 @@ var _122_host_roster_scaler_managed_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$29(db) {
+async function up$31(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9051,7 +9051,7 @@ async function up$29(db) {
       ADD COLUMN scaler_managed boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$29(db) {
+async function down$31(db) {
 	await sql`
     ALTER TABLE public.host_roster DROP COLUMN IF EXISTS scaler_managed
   `.execute(db);
@@ -9059,8 +9059,8 @@ async function down$29(db) {
 //#endregion
 //#region src/db/migrations/123_workflow_registrations_default_branch.ts
 var _123_workflow_registrations_default_branch_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add `workflow_registrations.default_branch text` (nullable).
@@ -9082,7 +9082,7 @@ var _123_workflow_registrations_default_branch_exports = /* @__PURE__ */ __expor
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$28(db) {
+async function up$30(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9096,7 +9096,7 @@ async function up$28(db) {
       ADD COLUMN default_branch text
   `.execute(db);
 }
-async function down$28(db) {
+async function down$30(db) {
 	await sql`
     ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS default_branch
   `.execute(db);
@@ -9104,8 +9104,8 @@ async function down$28(db) {
 //#endregion
 //#region src/db/migrations/124_cluster_settings_provision_backoff.ts
 var _124_cluster_settings_provision_backoff_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Cluster-global tunables for backing off a repeatedly failing external
@@ -9154,17 +9154,17 @@ const COLUMNS$2 = [
 	"scaler_provision_backoff_max_ms",
 	"scaler_provision_max_consecutive_failures"
 ];
-async function up$27(db) {
+async function up$29(db) {
 	for (const column of COLUMNS$2) if (!await columnExists$1(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$27(db) {
+async function down$29(db) {
 	for (const column of COLUMNS$2) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/125_org_trust_directory.ts
 var _125_org_trust_directory_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Create `org_trust_directory` — the orchestrator's cache of the Platform-owned
@@ -9192,7 +9192,7 @@ var _125_org_trust_directory_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
 */
-async function up$26(db) {
+async function up$28(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.org_trust_directory (
       customer_id      TEXT PRIMARY KEY,
@@ -9203,14 +9203,14 @@ async function up$26(db) {
     )
   `.execute(db);
 }
-async function down$26(db) {
+async function down$28(db) {
 	await sql`DROP TABLE IF EXISTS public.org_trust_directory`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/126_held_runs_posted_pending_check.ts
 var _126_held_runs_posted_pending_check_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add `held_runs.posted_pending_check boolean` — whether this hold's pending
@@ -9236,7 +9236,7 @@ var _126_held_runs_posted_pending_check_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$25(db) {
+async function up$27(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9250,7 +9250,7 @@ async function up$25(db) {
       ADD COLUMN posted_pending_check boolean
   `.execute(db);
 }
-async function down$25(db) {
+async function down$27(db) {
 	await sql`
     ALTER TABLE public.held_runs DROP COLUMN IF EXISTS posted_pending_check
   `.execute(db);
@@ -9258,8 +9258,8 @@ async function down$25(db) {
 //#endregion
 //#region src/db/migrations/127_org_trust_policy_approval_expiry_seconds.ts
 var _127_org_trust_policy_approval_expiry_seconds_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add `org_trust_policy.approval_expiry_seconds` (nullable INTEGER).
@@ -9283,7 +9283,7 @@ var _127_org_trust_policy_approval_expiry_seconds_exports = /* @__PURE__ */ __ex
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$24(db) {
+async function up$26(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9294,14 +9294,14 @@ async function up$24(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.org_trust_policy ADD COLUMN approval_expiry_seconds INTEGER`.execute(db);
 }
-async function down$24(db) {
+async function down$26(db) {
 	await sql`ALTER TABLE public.org_trust_policy DROP COLUMN IF EXISTS approval_expiry_seconds`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/128_execution_runs_global_eval_round.ts
 var _128_execution_runs_global_eval_round_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add `execution_runs.is_global_eval_round boolean NOT NULL DEFAULT false` —
@@ -9322,7 +9322,7 @@ var _128_execution_runs_global_eval_round_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$23(db) {
+async function up$25(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9336,7 +9336,7 @@ async function up$23(db) {
       ADD COLUMN is_global_eval_round BOOLEAN NOT NULL DEFAULT FALSE
   `.execute(db);
 }
-async function down$23(db) {
+async function down$25(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS is_global_eval_round
   `.execute(db);
@@ -9344,8 +9344,8 @@ async function down$23(db) {
 //#endregion
 //#region src/db/migrations/129_execution_runs_dispatch_routing_key.ts
 var _129_execution_runs_dispatch_routing_key_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Add `execution_runs.dispatch_routing_key TEXT NULL` — the source whose
@@ -9367,7 +9367,7 @@ var _129_execution_runs_dispatch_routing_key_exports = /* @__PURE__ */ __exportA
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$22(db) {
+async function up$24(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9381,7 +9381,7 @@ async function up$22(db) {
       ADD COLUMN dispatch_routing_key TEXT
   `.execute(db);
 }
-async function down$22(db) {
+async function down$24(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS dispatch_routing_key
   `.execute(db);
@@ -9389,8 +9389,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/130_scaler_provision_outcomes.ts
 var _130_scaler_provision_outcomes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Durable per-provision outcome, keyed by agent id.
@@ -9420,7 +9420,7 @@ var _130_scaler_provision_outcomes_exports = /* @__PURE__ */ __exportAll({
 * no-op — including a re-run over a database that has the table but not the
 * index, which an existence probe over the table alone would skip.
 */
-async function up$21(db) {
+async function up$23(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.scaler_provision_outcomes (
       agent_id          TEXT PRIMARY KEY,
@@ -9438,14 +9438,14 @@ async function up$21(db) {
       ON public.scaler_provision_outcomes (updated_at)
   `.execute(db);
 }
-async function down$21(db) {
+async function down$23(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_provision_outcomes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/131_execution_jobs_git_credentials.ts
 var _131_execution_jobs_git_credentials_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add `execution_jobs.git_credentials JSONB NULL` — the `gitCredentials` map the
@@ -9473,7 +9473,7 @@ var _131_execution_jobs_git_credentials_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$20(db) {
+async function up$22(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9487,7 +9487,7 @@ async function up$20(db) {
       ADD COLUMN git_credentials JSONB
   `.execute(db);
 }
-async function down$20(db) {
+async function down$22(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS git_credentials
   `.execute(db);
@@ -9495,8 +9495,8 @@ async function down$20(db) {
 //#endregion
 //#region src/db/migrations/132_execution_runs_trigger_event.ts
 var _132_execution_runs_trigger_event_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add `execution_runs.trigger_event TEXT NULL` — the event type that started
@@ -9517,7 +9517,7 @@ var _132_execution_runs_trigger_event_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$19(db) {
+async function up$21(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9531,7 +9531,7 @@ async function up$19(db) {
       ADD COLUMN trigger_event TEXT
   `.execute(db);
 }
-async function down$19(db) {
+async function down$21(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_event
   `.execute(db);
@@ -9539,8 +9539,8 @@ async function down$19(db) {
 //#endregion
 //#region src/db/migrations/133_dispatch_queue_source_tar_digest.ts
 var _133_dispatch_queue_source_tar_digest_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Add `dispatch_queue.source_tar_digest TEXT NULL` — the SHA-256 of the source
@@ -9561,7 +9561,7 @@ var _133_dispatch_queue_source_tar_digest_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$18(db) {
+async function up$20(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9575,7 +9575,7 @@ async function up$18(db) {
       ADD COLUMN source_tar_digest TEXT
   `.execute(db);
 }
-async function down$18(db) {
+async function down$20(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS source_tar_digest
   `.execute(db);
@@ -9583,8 +9583,8 @@ async function down$18(db) {
 //#endregion
 //#region src/db/migrations/134_dispatch_queue_ownership.ts
 var _134_dispatch_queue_ownership_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Coordinator ownership for the job-dispatch plane.
@@ -9637,7 +9637,7 @@ async function colExists$5(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const DISPATCH_QUEUE_COLUMNS = [["owner_instance_id", "TEXT"], ["dispatched_at", "TIMESTAMPTZ"]];
-async function up$17(db) {
+async function up$19(db) {
 	for (const [name, type] of DISPATCH_QUEUE_COLUMNS) if (!await colExists$5(db, "dispatch_queue", name)) await sql`
         ALTER TABLE public.dispatch_queue
           ADD COLUMN ${sql.raw(name)} ${sql.raw(type)}
@@ -9698,7 +9698,7 @@ async function up$17(db) {
      WHERE status = 'active'
   `.execute(db);
 }
-async function down$17(db) {
+async function down$19(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_concurrency_groups_active_unique`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.cluster_instances`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelling_at`.execute(db);
@@ -9709,8 +9709,8 @@ async function down$17(db) {
 //#endregion
 //#region src/db/migrations/135_cluster_settings_retention_days.ts
 var _135_cluster_settings_retention_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add the database-side retention windows to `cluster_settings`.
@@ -9772,20 +9772,20 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$16(db) {
+async function up$18(db) {
 	for (const { name, type } of COLUMNS$1) {
 		if (await columnExists(db, name)) continue;
 		await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.raw(name)} ${sql.raw(type)}`.execute(db);
 	}
 }
-async function down$16(db) {
+async function down$18(db) {
 	for (const { name } of COLUMNS$1) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.raw(name)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/136_master_key_wrapped_tables_key_version.ts
 var _136_master_key_wrapped_tables_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add `key_version INTEGER NOT NULL DEFAULT 1` to the three master-key-wrapped
@@ -9811,7 +9811,7 @@ const TABLES = [
 	"run_ephemeral_keys",
 	"run_secret_outputs"
 ];
-async function up$15(db) {
+async function up$17(db) {
 	for (const table of TABLES) {
 		if ((await sql`
       SELECT EXISTS (
@@ -9827,7 +9827,7 @@ async function up$15(db) {
     `.execute(db);
 	}
 }
-async function down$15(db) {
+async function down$17(db) {
 	for (const table of TABLES) await sql`
       ALTER TABLE public.${sql.raw(table)} DROP COLUMN IF EXISTS key_version
     `.execute(db);
@@ -9835,8 +9835,8 @@ async function down$15(db) {
 //#endregion
 //#region src/db/migrations/137_execution_runs_pr_head_context.ts
 var _137_execution_runs_pr_head_context_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add the pull-request head context to `execution_runs`: `head_ref TEXT`,
@@ -9872,7 +9872,7 @@ const COLUMNS = [
 	["head_repository", "TEXT"],
 	["is_fork", "BOOLEAN"]
 ];
-async function up$14(db) {
+async function up$16(db) {
 	for (const [name, type] of COLUMNS) {
 		if ((await sql`
       SELECT EXISTS (
@@ -9888,7 +9888,7 @@ async function up$14(db) {
     `.execute(db);
 	}
 }
-async function down$14(db) {
+async function down$16(db) {
 	for (const [name] of COLUMNS) await sql`
       ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS ${sql.raw(name)}
     `.execute(db);
@@ -9896,8 +9896,8 @@ async function down$14(db) {
 //#endregion
 //#region src/db/migrations/138_execution_runs_subject_trigger_event.ts
 var _138_execution_runs_subject_trigger_event_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Add `execution_runs.subject_trigger_event TEXT`, nullable.
@@ -9923,7 +9923,7 @@ var _138_execution_runs_subject_trigger_event_exports = /* @__PURE__ */ __export
 * a re-run is a no-op.
 */
 const COLUMN$1 = "subject_trigger_event";
-async function up$13(db) {
+async function up$15(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9937,7 +9937,7 @@ async function up$13(db) {
       ADD COLUMN ${sql.raw(COLUMN$1)} TEXT
   `.execute(db);
 }
-async function down$13(db) {
+async function down$15(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS ${sql.raw(COLUMN$1)}
   `.execute(db);
@@ -9945,8 +9945,8 @@ async function down$13(db) {
 //#endregion
 //#region src/db/migrations/139_admin_token_subject.ts
 var _139_admin_token_subject_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Add `admin_tokens.subject TEXT`, nullable.
@@ -9971,7 +9971,7 @@ var _139_admin_token_subject_exports = /* @__PURE__ */ __exportAll({
 * a re-run is a no-op.
 */
 const COLUMN = "subject";
-async function up$12(db) {
+async function up$14(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9985,7 +9985,7 @@ async function up$12(db) {
       ADD COLUMN ${sql.raw(COLUMN)} TEXT
   `.execute(db);
 }
-async function down$12(db) {
+async function down$14(db) {
 	await sql`
     ALTER TABLE public.admin_tokens DROP COLUMN IF EXISTS ${sql.raw(COLUMN)}
   `.execute(db);
@@ -9993,8 +9993,8 @@ async function down$12(db) {
 //#endregion
 //#region src/db/migrations/140_dispatch_queue_canonical_labels.ts
 var _140_dispatch_queue_canonical_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * The whitespace `btrim` strips, chosen to match `String.prototype.trim`, which
@@ -10050,7 +10050,7 @@ const TRIM_CHARS = String.raw`E' \t\n\r\f\x0B'`;
 * Idempotent: each `UPDATE` selects only rows holding an element that is not
 * already its own canonical form, so a re-run touches nothing.
 */
-async function up$11(db) {
+async function up$13(db) {
 	const trim = sql.raw(TRIM_CHARS);
 	await sql`
     UPDATE public.dispatch_queue
@@ -10088,12 +10088,12 @@ async function up$11(db) {
 * migration canonicalized, so a fleet whose configured labels are not already
 * lowercase strands those rows until they expire, drain, or are re-enqueued.
 */
-async function down$11() {}
+async function down$13() {}
 //#endregion
 //#region src/db/migrations/141_event_log_shed.ts
 var _141_event_log_shed_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Extend the event_log.status CHECK constraint with 'shed' so the orchestrator
@@ -10106,7 +10106,7 @@ var _141_event_log_shed_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$10(db) {
+async function up$12(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -10116,7 +10116,7 @@ async function up$10(db) {
     ])))
   `.execute(db);
 }
-async function down$10(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -10129,8 +10129,8 @@ async function down$10(db) {
 //#endregion
 //#region src/db/migrations/142_sweep_deprecated_columns.ts
 var _142_sweep_deprecated_columns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Sweep the columns and stored values that no code path reads or writes any
@@ -10164,7 +10164,7 @@ var _142_sweep_deprecated_columns_exports = /* @__PURE__ */ __exportAll({
 * guarded by IF EXISTS.
 */
 const BATCH_SIZE = 5e3;
-async function up$9(db) {
+async function up$11(db) {
 	for (;;) if (((await sql`
       UPDATE public.execution_runs
          SET trust_tier = 'unknown'
@@ -10190,12 +10190,12 @@ async function up$9(db) {
 	await sql`ALTER TABLE public.org_trust_policy DROP COLUMN IF EXISTS workflow_change_policy`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS source_tar_hash`.execute(db);
 }
-async function down$9() {}
+async function down$11() {}
 //#endregion
 //#region src/db/migrations/143_execution_jobs_precursor_result.ts
 var _143_execution_jobs_precursor_result_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add `execution_jobs.precursor_result JSONB NULL` — the payload a precursor
@@ -10219,7 +10219,7 @@ var _143_execution_jobs_precursor_result_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$8(db) {
+async function up$10(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -10233,7 +10233,7 @@ async function up$8(db) {
       ADD COLUMN precursor_result JSONB
   `.execute(db);
 }
-async function down$8(db) {
+async function down$10(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS precursor_result
   `.execute(db);
@@ -10241,8 +10241,8 @@ async function down$8(db) {
 //#endregion
 //#region src/db/migrations/144_execution_runs_registration_window.ts
 var _144_execution_runs_registration_window_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add `execution_runs.registration_window_instance_id TEXT NULL` — the
@@ -10272,7 +10272,7 @@ var _144_execution_runs_registration_window_exports = /* @__PURE__ */ __exportAl
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$7(db) {
+async function up$9(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -10286,7 +10286,7 @@ async function up$7(db) {
       ADD COLUMN registration_window_instance_id TEXT
   `.execute(db);
 }
-async function down$7(db) {
+async function down$9(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS registration_window_instance_id
   `.execute(db);
@@ -10294,8 +10294,8 @@ async function down$7(db) {
 //#endregion
 //#region src/db/migrations/145_execution_runs_workflow_provenance.ts
 var _145_execution_runs_workflow_provenance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Record the workflow repository's commit and registered branch for a run whose
@@ -10322,19 +10322,19 @@ async function colExists$4(db, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$6(db) {
+async function up$8(db) {
 	if (!await colExists$4(db, "workflow_sha")) await sql`ALTER TABLE public.execution_runs ADD COLUMN workflow_sha text`.execute(db);
 	if (!await colExists$4(db, "workflow_branch")) await sql`ALTER TABLE public.execution_runs ADD COLUMN workflow_branch text`.execute(db);
 }
-async function down$6(db) {
+async function down$8(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_branch`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_sha`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/146_pending_job_contexts_context_resolution.ts
 var _146_pending_job_contexts_context_resolution_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Record, with a held job's pending dispatch context, what the release path
@@ -10360,18 +10360,18 @@ async function colExists$3(db) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$5(db) {
+async function up$7(db) {
 	if (!await colExists$3(db)) await sql`ALTER TABLE public.pending_job_contexts ADD COLUMN context_resolution jsonb`.execute(db);
 }
-async function down$5(db) {
+async function down$7(db) {
 	await sql`ALTER TABLE public.pending_job_contexts DROP COLUMN IF EXISTS context_resolution`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/147_sealed_job_secrets.ts
 var _147_sealed_job_secrets_exports = /* @__PURE__ */ __exportAll({
 	SEALED_SECRETS_TABLES: () => SEALED_SECRETS_TABLES,
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Hold the secret fields of a stored job encrypted under the orchestrator
@@ -10402,17 +10402,17 @@ async function colExists$2(db, table) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$4(db) {
+async function up$6(db) {
 	for (const table of SEALED_SECRETS_TABLES) if (!await colExists$2(db, table)) await sql`ALTER TABLE ${sql.table(`public.${table}`)} ADD COLUMN sealed_secrets text`.execute(db);
 }
-async function down$4(db) {
+async function down$6(db) {
 	for (const table of SEALED_SECRETS_TABLES) await sql`ALTER TABLE ${sql.table(`public.${table}`)} DROP COLUMN IF EXISTS sealed_secrets`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/148_cluster_settings_sealed_secrets_retry_backoff_ms.ts
 var _148_cluster_settings_sealed_secrets_retry_backoff_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Add `cluster_settings.sealed_secrets_retry_backoff_ms` (nullable bigint).
@@ -10431,7 +10431,7 @@ var _148_cluster_settings_sealed_secrets_retry_backoff_ms_exports = /* @__PURE__
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$3(db) {
+async function up$5(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -10442,14 +10442,14 @@ async function up$3(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN sealed_secrets_retry_backoff_ms BIGINT`.execute(db);
 }
-async function down$3(db) {
+async function down$5(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS sealed_secrets_retry_backoff_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/149_workflow_registrations_dep_cache_key.ts
 var _149_workflow_registrations_dep_cache_key_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Record the dependency-cache key of the lock file that registered a workflow.
@@ -10477,19 +10477,19 @@ async function colExists$1(db, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$2(db) {
+async function up$4(db) {
 	if (!await colExists$1(db, "lockfile_hash")) await sql`ALTER TABLE public.workflow_registrations ADD COLUMN lockfile_hash text`.execute(db);
 	if (!await colExists$1(db, "siblings_digest")) await sql`ALTER TABLE public.workflow_registrations ADD COLUMN siblings_digest text`.execute(db);
 }
-async function down$2(db) {
+async function down$4(db) {
 	await sql`ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS siblings_digest`.execute(db);
 	await sql`ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS lockfile_hash`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/150_execution_runs_status_epoch.ts
 var _150_execution_runs_status_epoch_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * Add `execution_runs.status_epoch` (integer, NOT NULL, default 0).
@@ -10505,7 +10505,7 @@ var _150_execution_runs_status_epoch_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on the column's existence, so re-running is a no-op.
 */
-async function up$1(db) {
+async function up$3(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -10516,14 +10516,14 @@ async function up$1(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.execution_runs ADD COLUMN status_epoch INTEGER NOT NULL DEFAULT 0`.execute(db);
 }
-async function down$1(db) {
+async function down$3(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS status_epoch`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/151_workflow_registrations_dep_cache_key_sha.ts
 var _151_workflow_registrations_dep_cache_key_sha_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * Record the commit a workflow registration's dependency-cache key was written for.
@@ -10553,14 +10553,87 @@ async function colExists(db) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up(db) {
+async function up$2(db) {
 	if (await colExists(db)) return;
 	await sql`ALTER TABLE public.workflow_registrations ADD COLUMN dep_cache_key_sha text`.execute(db);
 }
-async function down(db) {
+async function down$2(db) {
 	await sql`ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS dep_cache_key_sha`.execute(db);
 }
 //#endregion
+//#region src/db/migrations/152_org_settings_cache_upload_settle_timeout.ts
+var _152_org_settings_cache_upload_settle_timeout_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Add `org_settings.cache_upload_settle_timeout_ms BIGINT` (nullable).
+*
+* Per-org bound on how long a build job's `job.status success` waits for the
+* cache publish (object metadata plus pointer) its agent reported just before
+* it. NULL falls back to the cluster default
+* (`KICI_CACHE_UPLOAD_SETTLE_TIMEOUT_MS`, 10s); 0 turns the wait off. Operators
+* tune it via `kici-admin org-settings cache-upload-settle`.
+*
+* Idempotent: a re-run on a DB that already has the column is a no-op.
+*/
+async function up$1(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'org_settings'
+         AND column_name = 'cache_upload_settle_timeout_ms'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`
+    ALTER TABLE public.org_settings
+      ADD COLUMN cache_upload_settle_timeout_ms BIGINT
+  `.execute(db);
+}
+async function down$1(db) {
+	await sql`
+    ALTER TABLE public.org_settings DROP COLUMN IF EXISTS cache_upload_settle_timeout_ms
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/153_execution_runs_cancel_force.ts
+var _153_execution_runs_cancel_force_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add `execution_runs.cancel_force BOOLEAN` (nullable, no default).
+*
+* TRUE once a forced cancel reached the run. The leader's stuck-cancelling
+* sweep reads it to re-send a cancel that did not complete with `force` set,
+* so a forced cancel whose first forward to a sibling coordinator was lost is
+* not re-sent as a graceful one. NULL (every existing row, and every run no
+* forced cancel reached) re-sends gracefully. No backfill: nothing recorded
+* whether an earlier cancel was forced.
+*
+* Idempotent: a re-run on a DB that already has the column is a no-op.
+*/
+async function up(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'execution_runs'
+         AND column_name = 'cancel_force'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`
+    ALTER TABLE public.execution_runs
+      ADD COLUMN cancel_force BOOLEAN
+  `.execute(db);
+}
+async function down(db) {
+	await sql`
+    ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancel_force
+  `.execute(db);
+}
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -10715,7 +10788,9 @@ function createMigrationProvider() {
 			"148_cluster_settings_sealed_secrets_retry_backoff_ms": _148_cluster_settings_sealed_secrets_retry_backoff_ms_exports,
 			"149_workflow_registrations_dep_cache_key": _149_workflow_registrations_dep_cache_key_exports,
 			"150_execution_runs_status_epoch": _150_execution_runs_status_epoch_exports,
-			"151_workflow_registrations_dep_cache_key_sha": _151_workflow_registrations_dep_cache_key_sha_exports
+			"151_workflow_registrations_dep_cache_key_sha": _151_workflow_registrations_dep_cache_key_sha_exports,
+			"152_org_settings_cache_upload_settle_timeout": _152_org_settings_cache_upload_settle_timeout_exports,
+			"153_execution_runs_cancel_force": _153_execution_runs_cancel_force_exports
 		};
 	} };
 }
@@ -10728,7 +10803,7 @@ function createMigrationProvider() {
 * migrations at a time, preventing conflicts in multi-instance deployments.
 */
 init_client();
-const logger$23 = createLogger({ prefix: "migrate" });
+const logger$24 = createLogger({ prefix: "migrate" });
 const ADVISORY_LOCK_KEY = 543210001;
 /**
 * Wrap every migration's `up` so each one's own elapsed time is measured,
@@ -10775,9 +10850,9 @@ function describeMigrationFailure(message, migrationName) {
 async function runMigrations(opts) {
 	const client = await opts.pool.connect();
 	try {
-		logger$23.info("Acquiring migration lock...");
+		logger$24.info("Acquiring migration lock...");
 		await client.query("SELECT pg_advisory_lock($1)", [ADVISORY_LOCK_KEY]);
-		logger$23.info("Migration lock acquired");
+		logger$24.info("Migration lock acquired");
 		const elapsedMs = /* @__PURE__ */ new Map();
 		const { results, error } = await new Migrator({
 			db: opts.db,
@@ -10786,18 +10861,18 @@ async function runMigrations(opts) {
 		for (const result of results ?? []) {
 			const took = elapsedMs.get(result.migrationName);
 			const suffix = took === void 0 ? "" : ` (${took}ms)`;
-			if (result.status === "Success") logger$23.info(`${result.migrationName} ... OK${suffix}`);
-			else if (result.status === "Error") logger$23.error(`${result.migrationName} ... FAILED${suffix}`);
+			if (result.status === "Success") logger$24.info(`${result.migrationName} ... OK${suffix}`);
+			else if (result.status === "Error") logger$24.error(`${result.migrationName} ... FAILED${suffix}`);
 		}
 		if (error) {
 			const failed = (results ?? []).find((r) => r.status === "Error")?.migrationName;
 			const described = describeMigrationFailure(error instanceof Error ? error.message : String(error), failed);
-			logger$23.error(described);
+			logger$24.error(described);
 			throw new Error(described, { cause: error });
 		}
 		const applied = (results ?? []).filter((r) => r.status === "Success");
-		if (applied.length === 0) logger$23.info("Database schema is up to date");
-		else logger$23.info(`Applied ${applied.length} migration(s)`);
+		if (applied.length === 0) logger$24.info("Database schema is up to date");
+		else logger$24.info(`Applied ${applied.length} migration(s)`);
 		const hash = await computeMigrationsHash(createMigrationProvider());
 		await storeMigrationContentHash(opts.pool, hash);
 		return results ?? [];
@@ -10859,7 +10934,7 @@ var SamplingRateLimiter = class {
 //#endregion
 //#region src/audit/access-log.ts
 init_load_access_log_range();
-const logger$22 = createLogger({ prefix: "access-log" });
+const logger$23 = createLogger({ prefix: "access-log" });
 /**
 * Best-effort writer for the orchestrator `access_log` table. Records one
 * row per read / orchestrator-admin mutation attributable to an
@@ -10892,7 +10967,7 @@ var AccessLogWriter = class {
 		try {
 			await this.insert(this.db, entry);
 		} catch (err) {
-			logger$22.error("access_log record failed", {
+			logger$23.error("access_log record failed", {
 				error: toErrorMessage(err),
 				action: entry.action,
 				source: entry.source
@@ -11002,7 +11077,7 @@ var AccessLogWriter = class {
 				fromTs: /* @__PURE__ */ new Date(0)
 			})) if (String(row.id) === id) return toAccessLogItem(row);
 		} catch (err) {
-			logger$22.warn("cold-store fetchRange failed for access-log getById", {
+			logger$23.warn("cold-store fetchRange failed for access-log getById", {
 				id,
 				tenantId,
 				error: toErrorMessage(err)
@@ -11029,7 +11104,7 @@ var AccessLogWriter = class {
 * down an admin command. This recorder inherits that contract.
 */
 init_client();
-const logger$21 = createLogger({ prefix: "admin-cli-access-log" });
+const logger$22 = createLogger({ prefix: "admin-cli-access-log" });
 /**
 * The actor for a bare-metal CLI operator. There is no Keycloak sub on the
 * box, so we attribute to a service_account keyed on the OS identity — the
@@ -11063,7 +11138,7 @@ async function recordAdminCliAccessOnDb(db, entry) {
 			meta: entry.meta
 		});
 	} catch (err) {
-		logger$21.warn("admin_cli access-log record failed", {
+		logger$22.warn("admin_cli access-log record failed", {
 			action: entry.action,
 			error: toErrorMessage(err)
 		});
@@ -14799,7 +14874,18 @@ const UniversalGitPayloadPathsSchema = z.object({
 	* config written before this field stays valid; when unset, a `commitMessage`
 	* trigger filter is INDETERMINATE and the workflow does not run.
 	*/
-	commitMessage: z.string().min(1).optional()
+	commitMessage: z.string().min(1).optional(),
+	/**
+	* Path to the forge's total commit count on a push. When the total exceeds
+	* the commits listed, the payload was truncated and its file list is not
+	* authoritative.
+	*/
+	commitsTotal: z.string().min(1).optional(),
+	/**
+	* The most commits the forge lists in a push payload, for a forge that sends
+	* no total. A push listing this many may be truncated.
+	*/
+	commitsCap: z.number().int().positive().optional()
 });
 /**
 * Header-to-event-name mapping. Most forges send an `X-Event-Type`-style
@@ -14899,7 +14985,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
 			commitsRemoved: "$.commits[*].removed[*]",
-			commitMessage: "$.head_commit.message"
+			commitMessage: "$.head_commit.message",
+			commitsTotal: "$.total_commits"
 		},
 		eventMapping: {
 			push: ["push"],
@@ -14916,7 +15003,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
 			commitsRemoved: "$.commits[*].removed[*]",
-			commitMessage: "$.head_commit.message"
+			commitMessage: "$.head_commit.message",
+			commitsTotal: "$.total_commits"
 		},
 		eventMapping: {
 			push: ["push"],
@@ -14950,7 +15038,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
 			commitsRemoved: "$.commits[*].removed[*]",
-			commitMessage: "$.commits[-1:].message"
+			commitMessage: "$.commits[-1:].message",
+			commitsTotal: "$.total_commits_count"
 		},
 		eventMapping: {
 			push: ["Push Hook", "push"],
@@ -14967,7 +15056,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
 			commitsRemoved: "$.commits[*].removed[*]",
-			commitMessage: "$.head_commit.message"
+			commitMessage: "$.head_commit.message",
+			commitsCap: 2048
 		},
 		eventMapping: {
 			push: ["push"],
@@ -15022,7 +15112,7 @@ const LocalSourceConfigSchema = z.object({
 * the generic_webhook_sources table. Each source defines verification method,
 * event type extraction rules, rate limits, and header filtering.
 */
-const logger$20 = createLogger({ prefix: "generic-sources" });
+const logger$21 = createLogger({ prefix: "generic-sources" });
 /**
 * Generic webhook source manager.
 *
@@ -15075,7 +15165,7 @@ var GenericSourceManager = class {
 			git_config: gitConfigJson
 		};
 		const result = await this.db.insertInto("generic_webhook_sources").values(row).returningAll().executeTakeFirstOrThrow();
-		logger$20.info("Generic webhook source created", {
+		logger$21.info("Generic webhook source created", {
 			id: result.id,
 			orgId: input.orgId,
 			name: input.name,
@@ -15185,7 +15275,7 @@ var GenericSourceManager = class {
 			...updates,
 			updated_at: sql`now()`
 		}).where("id", "=", id).where("deleted_at", "is", null).returningAll().executeTakeFirst();
-		if (result) logger$20.info("Generic webhook source updated", {
+		if (result) logger$21.info("Generic webhook source updated", {
 			id,
 			fields: Object.keys(updates)
 		});
@@ -15196,14 +15286,14 @@ var GenericSourceManager = class {
 	*/
 	async softDelete(id) {
 		await this.db.updateTable("generic_webhook_sources").set({ deleted_at: sql`now()` }).where("id", "=", id).where("deleted_at", "is", null).execute();
-		logger$20.info("Generic webhook source soft-deleted", { id });
+		logger$21.info("Generic webhook source soft-deleted", { id });
 	}
 	/**
 	* Hard delete a source (removes the row entirely).
 	*/
 	async hardDelete(id) {
 		await this.db.deleteFrom("generic_webhook_sources").where("id", "=", id).execute();
-		logger$20.info("Generic webhook source hard-deleted", { id });
+		logger$21.info("Generic webhook source hard-deleted", { id });
 	}
 	/**
 	* Enable a source.
@@ -15213,7 +15303,7 @@ var GenericSourceManager = class {
 			enabled: true,
 			updated_at: sql`now()`
 		}).where("id", "=", id).where("deleted_at", "is", null).execute();
-		logger$20.info("Generic webhook source enabled", { id });
+		logger$21.info("Generic webhook source enabled", { id });
 	}
 	/**
 	* Disable a source.
@@ -15223,7 +15313,7 @@ var GenericSourceManager = class {
 			enabled: false,
 			updated_at: sql`now()`
 		}).where("id", "=", id).where("deleted_at", "is", null).execute();
-		logger$20.info("Generic webhook source disabled", { id });
+		logger$21.info("Generic webhook source disabled", { id });
 	}
 	/**
 	* Check if a request is a duplicate within the dedup window.
@@ -15301,6 +15391,7 @@ createLogger({ prefix: "universal-git:clone-token" });
 function buildLocalTriggerRequest(input) {
 	const body = JSON.stringify({
 		ref: input.ref,
+		...input.before && { before: input.before },
 		after: input.sha,
 		repository: {
 			full_name: input.repoFullName,
@@ -15336,6 +15427,28 @@ function readRepoHead(repoPath) {
 		sha
 	};
 }
+/** The parent of `sha` in a local repo, or undefined for a root commit or an unreadable repo. */
+function readParentSha(repoPath, sha) {
+	try {
+		return execFileSync("git", [
+			"-C",
+			repoPath,
+			"rev-parse",
+			"--verify",
+			"--quiet",
+			`${sha}^`
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim() || void 0;
+	} catch {
+		return;
+	}
+}
 /** POST the trigger request to the orchestrator base URL. Returns the HTTP status. */
 async function sendLocalTrigger(baseUrl, req) {
 	return (await fetch(`${baseUrl.replace(/\/$/, "")}${req.path}`, {
@@ -15353,8 +15466,9 @@ async function sendLocalTrigger(baseUrl, req) {
 */
 /**
 * Render the post-receive hook script. For each pushed ref the hook calls
-* `kici-admin source trigger-local <id> --ref <ref> --sha <new> --base-url <url>`,
-* so a push to any branch dispatches a run for that ref.
+* `kici-admin source trigger-local <id> --ref <ref> --before <old> --sha <new> --base-url <url>`,
+* so a push to any branch dispatches a run for that ref, and its changed files
+* are the commits the push added (`<old>..<new>`).
 */
 function renderPostReceiveHook(opts) {
 	return `#!/usr/bin/env bash
@@ -15362,7 +15476,7 @@ function renderPostReceiveHook(opts) {
 # Triggers a run for each pushed branch ref.
 set -euo pipefail
 while read -r _old _new ref; do
-  kici-admin source trigger-local ${opts.sourceId} --ref "$ref" --sha "$_new" --base-url ${opts.baseUrl}
+  kici-admin source trigger-local ${opts.sourceId} --ref "$ref" --before "$_old" --sha "$_new" --base-url ${opts.baseUrl}
 done
 `;
 }
@@ -16617,7 +16731,7 @@ function registerSourceCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	src.command("trigger-local <id>").description("Trigger a run against a local source (reads HEAD when --ref/--sha omitted)").option("--event <event>", "push | pull_request", "push").option("--ref <ref>", "Git ref (default: repo HEAD branch)").option("--sha <sha>", "Commit SHA (default: repo HEAD)").option("--repo-full-name <name>", "owner/name identifier used in the payload", "local/repo").option("--base-url <url>", "Orchestrator base URL", DEFAULT_ORCH_URL).action(async (id, opts) => {
+	src.command("trigger-local <id>").description("Trigger a run against a local source (reads HEAD when --ref/--sha omitted)").option("--event <event>", "push | pull_request", "push").option("--ref <ref>", "Git ref (default: repo HEAD branch)").option("--sha <sha>", "Commit SHA (default: repo HEAD)").option("--before <sha>", "Commit before the push; the changed files are before..sha (default: parent of --sha)").option("--repo-full-name <name>", "owner/name identifier used in the payload", "local/repo").option("--base-url <url>", "Orchestrator base URL", DEFAULT_ORCH_URL).action(async (id, opts) => {
 		try {
 			const { source } = await getClient().getGenericSource(id);
 			const cfg = parseLocalConfig(source);
@@ -16638,6 +16752,7 @@ function registerSourceCommands(program, getClient) {
 				event: opts.event === "pull_request" ? "pull_request" : "push",
 				ref: head.ref,
 				sha: head.sha,
+				before: opts.before ?? readParentSha(cfg.repoBasePath, head.sha),
 				defaultBranch: head.ref.replace("refs/heads/", "")
 			});
 			const status = await sendLocalTrigger(opts.baseUrl, req);
@@ -17489,6 +17604,7 @@ const baseSchema = z.object({
 	reconnectReplayWindowHours: z.coerce.number().positive().default(24),
 	cacheBuildTimeoutMs: z.coerce.number().default(6e5),
 	cacheMaxTarballBytes: z.coerce.number().default(524288e3),
+	cacheUploadSettleTimeoutMs: z.coerce.number().int().min(0).default(1e4),
 	userCacheQuotaBytes: z.coerce.number().int().positive().default(5368709120).describe("Cluster-wide default per-org byte quota for the user-facing cache (ctx.cache). A per-org override in org_settings.user_cache_quota_bytes (set via `kici-admin org-settings user-cache set-quota`) takes precedence when present."),
 	userCacheTtlMs: z.coerce.number().int().positive().default(6048e5).describe("Cluster-wide default per-entry TTL (ms) for the user-facing cache. A per-org override in org_settings.user_cache_ttl_ms (set via `kici-admin org-settings user-cache set-ttl`) takes precedence when present."),
 	artifactQuotaBytes: z.coerce.number().int().positive().default(21474836480).describe("Cluster-wide default per-org byte quota for user-facing artifacts (ctx.artifacts). A per-org override in org_settings.artifact_quota_bytes (set via `kici-admin org-settings artifacts set-quota`) takes precedence when present."),
@@ -17737,6 +17853,7 @@ const envDef = defineEnv({
 		reconnectReplayWindowHours: "KICI_ORCH_RECONNECT_REPLAY_WINDOW_HOURS",
 		cacheBuildTimeoutMs: "KICI_CACHE_BUILD_TIMEOUT_MS",
 		cacheMaxTarballBytes: "KICI_CACHE_MAX_TARBALL_BYTES",
+		cacheUploadSettleTimeoutMs: "KICI_CACHE_UPLOAD_SETTLE_TIMEOUT_MS",
 		userCacheQuotaBytes: "KICI_USER_CACHE_QUOTA_BYTES",
 		userCacheTtlMs: "KICI_USER_CACHE_TTL_MS",
 		artifactQuotaBytes: "KICI_ARTIFACT_QUOTA_BYTES",
@@ -18039,6 +18156,7 @@ function loadConfig(scope = ConfigScope.enum.runtime) {
 * TTL is enforced lazily: expired items are deleted on access.
 * Pre-signed URLs are generated for getUrl() with 15-minute expiry.
 */
+const logger$17 = createLogger({ prefix: "s3-cache" });
 /** Pre-signed download URL expiry in seconds (15 minutes) */
 const PRESIGNED_URL_EXPIRY_SECONDS = 900;
 /** Pre-signed upload URL expiry in seconds (30 minutes -- uploads take longer) */
@@ -18052,6 +18170,11 @@ var S3CacheStorage = class {
 	bucket;
 	prefix;
 	ttlMs;
+	/**
+	* False once the backend answered a conditional self-copy with
+	* `501 NotImplemented`. From then on `updateMeta` copies unconditionally.
+	*/
+	conditionalCopySupported = true;
 	constructor(options) {
 		this.bucket = options.bucket;
 		this.prefix = options.prefix;
@@ -18083,6 +18206,13 @@ var S3CacheStorage = class {
 	* Returns null if the object doesn't exist (NoSuchKey/NotFound).
 	*/
 	async readMeta(key) {
+		return (await this.readHead(key))?.meta ?? null;
+	}
+	/**
+	* Read an object's TTL metadata together with the ETag of the version it
+	* belongs to. Returns null if the object doesn't exist (NoSuchKey/NotFound).
+	*/
+	async readHead(key) {
 		try {
 			const head = await this.client.send(new HeadObjectCommand({
 				Bucket: this.bucket,
@@ -18092,8 +18222,11 @@ var S3CacheStorage = class {
 			const lastAccessedAt = head.Metadata?.["last-accessed-at"] ?? "";
 			if (!createdAt || !lastAccessedAt) return null;
 			return {
-				createdAt,
-				lastAccessedAt
+				meta: {
+					createdAt,
+					lastAccessedAt
+				},
+				...head.ETag && { etag: head.ETag }
 			};
 		} catch (err) {
 			if (this.isNotFoundError(err)) return null;
@@ -18103,8 +18236,41 @@ var S3CacheStorage = class {
 	/**
 	* Update metadata on an S3 object by copying it to itself.
 	* This is the standard S3 pattern for updating metadata without re-uploading data.
+	*
+	* The copy is conditional on `etag`, the version whose metadata the caller
+	* read. A self-copy is a whole-object write: without the condition, one that
+	* races a `put()` of the same key can land after it and write the older body
+	* back. Cache pointers are rewritten in place while builds publish them, so a
+	* touch-on-read racing a publish reverted the pointer to a tarball that no
+	* longer exists. `CopySourceIfMatch` pins the bytes copied to that version and
+	* `IfMatch` refuses the write unless the key still holds it.
+	*
+	* Returns false when the object was replaced since the read (`412`), or is
+	* being replaced right now (`409 ConditionalRequestConflict`): the newer
+	* write stamps metadata of its own, so there is nothing left to refresh.
+	*
+	* An S3-compatible backend that does not implement conditional copies
+	* answers `501 NotImplemented`. The copy then runs again without the
+	* condition, and later copies skip it, as on a backend that ignores the
+	* headers.
 	*/
-	async updateMeta(key, meta) {
+	async updateMeta(key, meta, etag) {
+		const condition = this.conditionalCopySupported ? etag : void 0;
+		try {
+			await this.copyOntoItself(key, meta, condition);
+			return true;
+		} catch (err) {
+			if (!condition) throw err;
+			if (this.isPreconditionFailedError(err) || this.isConditionalConflictError(err)) return false;
+			if (!this.isNotImplementedError(err)) throw err;
+			this.conditionalCopySupported = false;
+			logger$17.warn("The object store does not implement conditional copies; refreshing cache metadata unconditionally", { bucket: this.bucket });
+			await this.copyOntoItself(key, meta, void 0);
+			return true;
+		}
+	}
+	/** Copy an object onto itself with new TTL metadata, conditional on `etag` when given. */
+	async copyOntoItself(key, meta, etag) {
 		const objectKey = this.objectKey(key);
 		await this.client.send(new CopyObjectCommand({
 			Bucket: this.bucket,
@@ -18114,9 +18280,30 @@ var S3CacheStorage = class {
 			Metadata: {
 				"created-at": meta.createdAt,
 				"last-accessed-at": meta.lastAccessedAt
+			},
+			...etag && {
+				CopySourceIfMatch: etag,
+				IfMatch: etag
 			}
 		}));
 	}
+	/** Check if an error is a failed conditional request (PreconditionFailed, 412). */
+	isPreconditionFailedError(err) {
+		return this.hasErrorShape(err, "PreconditionFailed", 412);
+	}
+	/** Check if an error is a conditional write that raced another write (ConditionalRequestConflict, 409). */
+	isConditionalConflictError(err) {
+		return this.hasErrorShape(err, "ConditionalRequestConflict", 409);
+	}
+	/** Check if an error is a request the backend does not implement (NotImplemented, 501). */
+	isNotImplementedError(err) {
+		return this.hasErrorShape(err, "NotImplemented", 501);
+	}
+	hasErrorShape(err, name, status) {
+		if (typeof err !== "object" || err === null) return false;
+		if (err.name === name) return true;
+		return err.$metadata?.httpStatusCode === status;
+	}
 	/** Check if an error is a "not found" error (NoSuchKey, NotFound, 404). */
 	isNotFoundError(err) {
 		if (typeof err !== "object" || err === null) return false;
@@ -18141,8 +18328,9 @@ var S3CacheStorage = class {
 		}).done();
 	}
 	async get(key, ttlMsOverride) {
-		const meta = await this.readMeta(key);
-		if (!meta) return null;
+		const head = await this.readHead(key);
+		if (!head) return null;
+		const { meta, etag } = head;
 		if (this.isExpired(meta, ttlMsOverride)) {
 			await this.deleteObject(key);
 			return null;
@@ -18161,7 +18349,7 @@ var S3CacheStorage = class {
 		}
 		try {
 			meta.lastAccessedAt = (/* @__PURE__ */ new Date()).toISOString();
-			await this.updateMeta(key, meta);
+			await this.updateMeta(key, meta, etag);
 		} catch {}
 		return data;
 	}
@@ -18180,10 +18368,10 @@ var S3CacheStorage = class {
 		return existed;
 	}
 	async touch(key) {
-		const meta = await this.readMeta(key);
-		if (!meta) return;
-		meta.lastAccessedAt = (/* @__PURE__ */ new Date()).toISOString();
-		await this.updateMeta(key, meta);
+		const head = await this.readHead(key);
+		if (!head) return;
+		head.meta.lastAccessedAt = (/* @__PURE__ */ new Date()).toISOString();
+		await this.updateMeta(key, head.meta, head.etag);
 	}
 	async getUrl(key, ttlMsOverride) {
 		const meta = await this.readMeta(key);
@@ -23671,7 +23859,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.12.0";
+	return "0.13.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -24406,7 +24594,8 @@ function silenceJoinTokenLogger() {
 }
 const TOKEN_PREFIX = "kici_join_v1";
 const DEFAULT_EXPIRY_MS = 36e5;
-const TOKEN_ALREADY_USED_MESSAGE = "Join token has already been used. Generate a new token with: kici admin create-join-token";
+const TOKEN_ALREADY_USED_MESSAGE = "Join token has already been used. Create a new token with: kici-admin peer create-token";
+const TOKEN_EXPIRED_MESSAGE = "Join token has expired. Create a new token with: kici-admin peer create-token";
 var JoinTokenManager = class {
 	deps;
 	constructor(deps) {
@@ -24491,7 +24680,7 @@ var JoinTokenManager = class {
 		}
 		const row = await this.deps.db.selectFrom("join_tokens").selectAll().where("token_hash", "=", keys.validationHash).executeTakeFirst();
 		if (!row) throw new Error("Invalid join token");
-		if (new Date(row.expires_at).getTime() <= Date.now()) throw new Error("Join token has expired. Generate a new token with: kici admin create-join-token");
+		if (new Date(row.expires_at).getTime() <= Date.now()) throw new Error(TOKEN_EXPIRED_MESSAGE);
 		if (row.consumed_at) {
 			if (row.consumed_by_instance === peerInstanceId) {
 				joinTokenLogger.info("Re-validated join token for returning instance", {
@@ -24548,18 +24737,12 @@ function decryptBundle(data, encryptionKey) {
 	const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
 	return JSON.parse(decrypted.toString("utf-8"));
 }
-//#endregion
-//#region src/cluster/peer-credentials.ts
 /**
-* Peer credential management for cluster authentication.
-*
-* Provides two persistence layers:
-* 1. DB CRUD (PeerCredentialStore) — coordinator stores credentials for all peers
-* 2. File I/O (readCredentialFile/writeCredentialFile) — workers persist their
-*    credential locally for reconnection after restart
-*
-* Credential files are written with 0600 permissions to protect the secret.
+* `metadata` key set when a coordinator retires the self-issued credential its
+* previous run left behind. An operator revoke never sets it, which is how a
+* retirement is told apart from a revoke.
 */
+const RETIRED_BY_INSTANCE_KEY = "retiredByInstance";
 /** Default credential expiry: 90 days. */
 const DEFAULT_EXPIRY_DAYS = 90;
 /**
@@ -24596,7 +24779,8 @@ var PeerCredentialStore = class {
 					role: opts.role,
 					routing_keys: sql`${sql.val(opts.routingKeys)}`,
 					source_token_hash: opts.sourceTokenHash ?? null,
-					expires_at: expiresAt
+					expires_at: expiresAt,
+					...opts.metadata && { metadata: sql`${JSON.stringify(opts.metadata)}::jsonb` }
 				}).execute();
 				return Number(revokeResult?.numUpdatedRows ?? 0n);
 			});
@@ -24623,6 +24807,33 @@ var PeerCredentialStore = class {
 		return row ? mapRow(row) : null;
 	}
 	/**
+	* The credential row for `instanceId` that nobody revoked, expired or not.
+	* `peer_credentials_active_uniq` allows at most one.
+	*/
+	async findUnrevokedByInstanceId(instanceId) {
+		const row = await this.db.selectFrom("peer_credentials").selectAll().where("instance_id", "=", instanceId).where("revoked_at", "is", null).executeTakeFirst();
+		return row ? mapRow(row) : null;
+	}
+	/** The most recently revoked credential row for `instanceId`, or null. */
+	async findLatestRevokedByInstanceId(instanceId) {
+		const row = await this.db.selectFrom("peer_credentials").selectAll().where("instance_id", "=", instanceId).where("revoked_at", "is not", null).orderBy("revoked_at", "desc").executeTakeFirst();
+		return row ? mapRow(row) : null;
+	}
+	/**
+	* Revoke `instanceId`'s unrevoked, self-issued row whose hash is
+	* `credentialHash`, recording who retired it. Every condition sits in the
+	* WHERE clause, so a row that changed meanwhile is left alone.
+	* Returns whether a row was retired.
+	*/
+	async retireSelfIssued(opts) {
+		const marker = JSON.stringify({ [RETIRED_BY_INSTANCE_KEY]: opts.retiredByInstance });
+		const result = await this.db.updateTable("peer_credentials").set({
+			revoked_at: /* @__PURE__ */ new Date(),
+			metadata: sql`COALESCE(metadata, '{}'::jsonb) || ${marker}::jsonb`
+		}).where("instance_id", "=", opts.instanceId).where("credential_hash", "=", opts.credentialHash).where("revoked_at", "is", null).where(sql`metadata->>'issuance'`, "=", "self").executeTakeFirst();
+		return Number(result?.numUpdatedRows ?? 0n) > 0;
+	}
+	/**
 	* Update the last_seen_at timestamp for a credential.
 	* Optionally records which coordinator validated it.
 	*/
@@ -24667,7 +24878,8 @@ function mapRow(row) {
 		lastSeenAt: row.last_seen_at ? new Date(row.last_seen_at) : null,
 		lastValidatedBy: row.last_validated_by ?? null,
 		expiresAt: new Date(row.expires_at),
-		revokedAt: row.revoked_at ? new Date(row.revoked_at) : null
+		revokedAt: row.revoked_at ? new Date(row.revoked_at) : null,
+		metadata: row.metadata ?? {}
 	};
 }
 //#endregion
@@ -24691,6 +24903,23 @@ function formatPeerTable(peers) {
 		})
 	].join("\n");
 }
+/**
+* The `peer list --json` record. The credential hash is the HMAC key of every
+* proof, so it, the source-token hash and the raw metadata never leave the
+* database.
+*/
+function toPeerListEntry(p) {
+	return {
+		id: p.id,
+		instanceId: p.instanceId,
+		role: p.role,
+		selfIssued: p.metadata?.issuance === "self",
+		createdAt: p.createdAt.toISOString(),
+		lastSeenAt: p.lastSeenAt ? p.lastSeenAt.toISOString() : null,
+		lastValidatedBy: p.lastValidatedBy,
+		expiresAt: p.expiresAt.toISOString()
+	};
+}
 function registerPeerCommands(program, _getClient) {
 	const peer = program.command("peer").description("Manage peer tokens and credentials");
 	peer.command("create-token").description("Create a join token for a new peer").option("--role <role>", "Peer role (worker or coordinator)", "coordinator").option("--expiry-hours <hours>", "Token expiry in hours", "1").option("--org-id <id>", "Organization ID", "default").option("--routing-key <key>", "Routing key", "default").option("--created-by <actor>", "Attribution written to join_tokens.created_by", "cli").option("--json", "Emit JSON { token, role, expiresAt, orgId, routingKey } on stdout", false).action(async (opts) => {
@@ -24736,11 +24965,15 @@ function registerPeerCommands(program, _getClient) {
 			process.exit(1);
 		}
 	});
-	peer.command("list").description("List active peer credentials").action(async () => {
+	peer.command("list").description("List active peer credentials").option("--json", "Emit JSON { peers: [{ id, instanceId, role, selfIssued, createdAt, lastSeenAt, lastValidatedBy, expiresAt }] } on stdout", false).action(async (opts) => {
 		try {
 			const peers = await withDb(async (db) => {
 				return new PeerCredentialStore(db).listActive();
 			});
+			if (opts.json) {
+				console.log(JSON.stringify({ peers: peers.map(toPeerListEntry) }, null, 2));
+				return;
+			}
 			console.log(formatPeerTable(peers));
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
@@ -24752,7 +24985,7 @@ function registerPeerCommands(program, _getClient) {
 			await withDb(async (db) => {
 				await new PeerCredentialStore(db).revoke(opts.instanceId);
 			});
-			console.log(`Peer ${opts.instanceId} credential revoked. It will be disconnected on next heartbeat.`);
+			console.log(`Peer ${opts.instanceId} credential revoked. Its next connection attempt is refused; its open connections stay up.`);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -25362,6 +25595,7 @@ function formatSettings$1(s, format) {
 	lines.push(`Reroute max hops:      ${s.rerouteMaxHops === null ? "(cluster default)" : `${s.rerouteMaxHops}`}`);
 	lines.push(`Backup staleness warn: ${s.backupStalenessWarnHours === null ? "(cluster default)" : `${s.backupStalenessWarnHours} h`}`);
 	lines.push(`Queue timeout:         ${s.queueTimeoutMs === null ? "(cluster default)" : `${s.queueTimeoutMs} ms`}`);
+	lines.push(`Cache upload settle:   ${s.cacheUploadSettleTimeoutMs == null ? "(cluster default)" : `${s.cacheUploadSettleTimeoutMs} ms`}`);
 	lines.push(`Approval expiry:       ${s.approvalExpirySeconds} s`);
 	lines.push(`Allow self-approval:   ${s.allowSelfApproval}`);
 	const sandboxCaps = s.sandboxAllowedCapabilities ?? [];
@@ -25449,6 +25683,7 @@ function registerOrgSettingsCommands(program, getClient) {
 	registerRerouteCommands(orgSettings, getClient);
 	registerBackupFreshnessCommands(orgSettings, getClient);
 	registerQueueTimeoutCommands(orgSettings, getClient);
+	registerCacheUploadSettleCommands(orgSettings, getClient);
 	registerApprovalCommands(orgSettings, getClient);
 }
 /**
@@ -25602,6 +25837,54 @@ function registerQueueTimeoutCommands(orgSettings, getClient) {
 		}
 	});
 }
+/**
+* `kici-admin org-settings cache-upload-settle <show|set|reset>`.
+*
+* The per-org bound (`org_settings.cache_upload_settle_timeout_ms`) on how long
+* a build job's success waits for the cache publish its agent reported just
+* before it. null clears the override → cluster default; `set 0` turns the
+* wait off.
+*/
+function registerCacheUploadSettleCommands(orgSettings, getClient) {
+	const cs = orgSettings.command("cache-upload-settle").description("Manage how long a build success waits for its cache upload to publish (null = cluster default)");
+	cs.command("show").description("Print the current per-org cache upload settle timeout").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const settings = await fetchSettings$1(getClient(), customerId);
+			console.log(formatSettings$1(settings, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	cs.command("set").description("Set the per-org cache upload settle timeout in milliseconds (0 = no wait)").argument("<ms>", "Settle timeout in milliseconds (integer >= 0)").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (ms, opts) => {
+		const customerId = resolveCustomerId(opts);
+		const cacheUploadSettleTimeoutMs = parseIntFlag(ms, 0, "ms (milliseconds)");
+		try {
+			const updated = await patchSettings$1(getClient(), {
+				customerId,
+				cacheUploadSettleTimeoutMs
+			});
+			console.log(formatSettings$1(updated, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	cs.command("reset").description("Clear the per-org cache upload settle override (fall back to the cluster default)").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (opts) => {
+		const customerId = resolveCustomerId(opts);
+		try {
+			const updated = await patchSettings$1(getClient(), {
+				customerId,
+				cacheUploadSettleTimeoutMs: null
+			});
+			console.log(formatSettings$1(updated, opts.format));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+}
 /** Parse an integer CLI flag with a minimum, exiting with an error on failure. */
 function parseIntFlag(value, min, fieldLabel) {
 	const n = Number(value);
@@ -33956,6 +34239,18 @@ function buildAgentContainerHostConfig(input) {
 	};
 }
 //#endregion
+//#region src/scaler/container-runtime.ts
+/**
+* The container runtime behind a configured socket path.
+*
+* A path containing `podman` is Podman; any other path is Docker. The container
+* backend reads a configured `socketPath` this way, and the runtime it picks
+* only labels the agents' log source and the scaler diagnostics.
+*/
+function containerRuntimeForSocketPath(socketPath) {
+	return socketPath.includes("podman") ? "podman" : "docker";
+}
+//#endregion
 //#region src/scaler/container-backend.ts
 /**
 * Container scaler backend implementation.
@@ -34187,7 +34482,7 @@ var ContainerScalerBackend = class ContainerScalerBackend {
 			const runtime = options.runtime === "podman" ? "podman" : "docker";
 			backend = new ContainerScalerBackend(options, "", runtime);
 		} else if (options.socketPath) {
-			const runtime = options.socketPath.includes("podman") ? "podman" : "docker";
+			const runtime = containerRuntimeForSocketPath(options.socketPath);
 			logger$1.info(`Using configured socket at ${options.socketPath}`, { runtime });
 			backend = new ContainerScalerBackend(options, options.socketPath, runtime);
 		} else {
@@ -34502,24 +34797,29 @@ var ContainerScalerBackend = class ContainerScalerBackend {
 			all: true,
 			filters: { label: ["kici-managed=true", `kici-scaler-name=${this.name}`] }
 		});
-		let cleaned = 0;
 		const liveIps = new Set(this.containerIps.values());
-		for (const info of containers) {
+		const orphans = containers.filter((info) => {
 			const agentId = info.Labels?.["kici-agent-id"];
-			if (agentId && this.agents.has(agentId)) continue;
-			if (info.State === "running" && (!agentId || this.isRegistered(agentId))) continue;
-			const container = this.docker.getContainer(info.Id);
-			try {
-				await container.stop({ t: 5 });
-			} catch {}
-			try {
-				await container.remove({ force: true });
-				cleaned++;
-			} catch {}
-		}
+			if (agentId && this.agents.has(agentId)) return false;
+			return !(info.State === "running" && (!agentId || this.isRegistered(agentId)));
+		});
+		let cleaned = (await Promise.all(orphans.map((info) => this.removeOrphan(info.Id)))).filter(Boolean).length;
 		cleaned += await this.reapUnownedIsolationRules(liveIps);
 		return cleaned;
 	}
+	/** Stop and remove one orphaned agent container; true when it was removed. */
+	async removeOrphan(containerId) {
+		const container = this.docker.getContainer(containerId);
+		try {
+			await container.stop({ t: 5 });
+		} catch {}
+		try {
+			await container.remove({ force: true });
+			return true;
+		} catch {
+			return false;
+		}
+	}
 	/**
 	* Remove containers this backend spawned for one agent id.
 	*
@@ -35064,7 +35364,7 @@ Token vocabulary:
 * where no bundler substituted the constant — the same shape `server.ts` and
 * `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.12.0";
+const CLI_VERSION = "0.13.0";
 /**
 * Build the kici-admin Commander program with every command group registered.
 * Exported so the surface registry can walk the real command tree without