@kici-dev/orchestrator 0.15.0 → 0.17.0

package/dist/cluster/coordinator.d.ts

@@ -212,8 +212,8 @@ export declare class RunCoordinator {
      *   timer: whichever fires first removes the tracking entry.
      * - `final: false` — the worker is retrying. Re-arm the window for one more
      *   attempt plus the backoff; treat the `maxAttempts`-th such relay as final.
-     * - no verdict — an older worker that retries without a bound. The window
-     *   armed at the reroute keeps running unchanged.
+     * - no verdict — a repeated report of one failed spawn. The window armed at
+     *   the reroute keeps running unchanged.
      *
      * Two guards make the re-dispatch safe. First, source provenance: the failure
      * must come from `fromPeerId === tracked.peerId` (the authenticated connection

package/dist/cluster/peer-client.d.ts

@@ -14,10 +14,12 @@
  * frame after acceptance uses an application key that needs the shared secret.
  * A server that does not offer mutual-v2 gets no proof at all.
  */
-import { type PeerHeartbeat, type PeerToPeerMessage, type JobReroute, type JobProgress, type JobProgressAck, type PeerJobCancel, type PeerLogChunk, type PeerCacheUploadRequest, type PeerCacheUploadResponse, type PeerConfigReload, type PeerConfigReloadResponse, type PeerScalerOrphansRequest, type PeerForgetRequest, type PeerForgetResponse, type PeerScalerOrphansResponse, type PeerClusterSettingsRequest, type PeerClusterSettingsResponse, type PeerLogsCollectRequest, type PeerLeaving, type PeerAgentTokenRevoke, type RaftVoteRequest, type RaftVoteResponse, type RaftAppendEntries } from '@kici-dev/engine';
+import { type PeerHeartbeat, type PeerToPeerMessage, type JobReroute, type JobProgress, type JobProgressAck, type PeerJobCancel, type PeerLogChunk, type PeerCacheUploadRequest, type PeerCacheUploadResponse, type PeerConfigReload, type PeerConfigReloadResponse, type PeerScalerOrphansRequest, type PeerForgetRequest, type PeerForgetResponse, type PeerScalerOrphansResponse, type PeerClusterSettingsRequest, type PeerClusterSettingsResponse, type PeerLogsCollectRequest, type PeerLeaving, type PeerAgentTokenRevoke, type RaftVoteRequest, type RaftVoteResponse, type RaftAppendEntries, type PeerScalerReloadRequest, type PeerScalerReloadResponse } from '@kici-dev/engine';
 import { type PeerRegistry } from './peer-registry.js';
 import { type PEER_FORGET_TIMEOUT, type PeerForgetRequestHandler } from './peer-forget.js';
 import { type SCALER_ORPHANS_TIMEOUT, type ScalerOrphansRequestHandler } from './scaler-orphans-peer.js';
+import type { PEER_REQUEST_TIMEOUT } from './peer-request-waiters.js';
+import type { ScalerFileReload } from '../scaler/file-reload.js';
 import type { PeerAuthCoordinator } from './peer-auth-coordinator.js';
 /** Logged when this instance has neither a credential file nor a join token. */
 export declare const NO_AUTH_METHOD_MESSAGE = "No peer auth method: this instance has no credential file and no join token";
@@ -140,6 +142,12 @@ export interface PeerClientOptions {
      * requests are answered with ok=false.
      */
     onScalerOrphansRequest?: ScalerOrphansRequestHandler;
+    /**
+     * Reloads this node's scaler config for a peer.scaler.reload.request the
+     * connected coordinator sent (`kici-admin scaler reload`). If undefined,
+     * requests are answered `rejected`.
+     */
+    onScalerReloadRequest?: ScalerFileReload;
     /**
      * Forgets a departed peer the connected coordinator forgot (`kici-admin peer
      * forget`). If undefined, requests are answered with outcome `error`.
@@ -173,6 +181,7 @@ export declare class PeerClient {
     private readonly cacheWaiters;
     private readonly configReloadWaiters;
     private readonly scalerOrphansWaiters;
+    private readonly scalerReloadWaiters;
     private readonly peerForgetWaiters;
     private readonly clusterSettingsWaiters;
     /** Correlates peer.logs.collect.request with the peer's chunked subtree response. */
@@ -211,6 +220,7 @@ export declare class PeerClient {
     private readonly onAuthenticated?;
     private readonly onLogsCollectRequest?;
     private readonly onScalerOrphansRequest?;
+    private readonly onScalerReloadRequest?;
     private readonly onPeerForgetRequest?;
     constructor(options: PeerClientOptions);
     /** Current connection state. */
@@ -266,6 +276,14 @@ export declare class PeerClient {
      *   response arrived within `timeoutMs`.
      */
     sendScalerOrphansAndWait(msg: PeerScalerOrphansRequest, timeoutMs: number): Promise<PeerScalerOrphansResponse | null | typeof SCALER_ORPHANS_TIMEOUT>;
+    /**
+     * Send a peer.scaler.reload.request to the connected peer and wait for the
+     * matching response.
+     *
+     * @returns the response; null when not connected; `'timeout'` when no
+     *   response arrived within `timeoutMs`.
+     */
+    sendScalerReloadAndWait(msg: PeerScalerReloadRequest, timeoutMs: number): Promise<PeerScalerReloadResponse | null | typeof PEER_REQUEST_TIMEOUT>;
     /**
      * Send a peer.clusterSettings.request to the connected coordinator and wait for
      * the matching peer.clusterSettings.response carrying the worker-settings snapshot.
@@ -342,6 +360,14 @@ export declare class PeerClient {
      * client never reads or writes the credential file directly.
      */
     private sendAuthRequest;
+    /**
+     * Route the operator-relay pairs (`scaler orphans --target`, `peer forget`,
+     * `scaler reload`): answer a request from the coordinator this client
+     * dialled, or hand a response to the request waiting for it.
+     *
+     * @returns whether `msg` was one of them.
+     */
+    private routeOperatorRelay;
     private routeMessage;
     private startHeartbeat;
     private stopHeartbeat;

package/dist/cluster/peer-forget.d.ts

@@ -1,6 +1,7 @@
 import { PeerForgetOutcome, type PeerForgetRequest, type PeerForgetResponse } from '@kici-dev/engine';
 import { z } from 'zod';
 import type { PeerRegistry } from './peer-registry.js';
+import { PeerRequestWaiters } from './peer-request-waiters.js';
 /** What forgetting did on one coordinator. */
 export interface PeerForgetResult {
     /** The coordinator that answered. */
@@ -125,14 +126,8 @@ export declare function forgetAcrossCoordinators(registry: PeerRegistry, selfIns
  * link to: registered coordinators whose connection is down.
  */
 export declare function disconnectedCoordinatorIds(registry: PeerRegistry, selfInstanceId: string): string[];
-/** Pending forget requests sent to siblings, keyed by message id. */
-export declare class PeerForgetWaiters {
-    private readonly waiters;
-    /** Wait for the response to `messageId`, or {@link PEER_FORGET_TIMEOUT}. */
-    wait(messageId: string, timeoutMs: number): Promise<PeerForgetResponse | typeof PEER_FORGET_TIMEOUT>;
-    /** Hand a response to the request waiting for it. An unknown id is dropped. */
-    resolve(response: PeerForgetResponse): void;
-    /** End every pending wait with an `error` response naming `reason`. */
-    rejectAll(reason: string): void;
+/** Pending forget requests sent to siblings; a close answers each `error` naming the reason. */
+export declare class PeerForgetWaiters extends PeerRequestWaiters<PeerForgetResponse> {
+    constructor();
 }
 //# sourceMappingURL=peer-forget.d.ts.map

package/dist/cluster/peer-handler.d.ts

@@ -11,10 +11,12 @@
  * with PEER_MUTUAL_AUTH_REQUIRED_REASON. Registers the peer in PeerRegistry and
  * routes messages bidirectionally. Sends periodic heartbeats to the peer.
  */
-import { type PeerHeartbeat, type PeerToPeerMessage, type JobReroute, type JobProgress, type JobProgressAck, type PeerScalerEvent, type PeerJobCancel, type PeerLogChunk, type PeerCacheUploadRequest, type PeerCacheUploadResponse, type PeerConfigReload, type PeerConfigReloadResponse, type PeerScalerOrphansRequest, type PeerForgetRequest, type PeerForgetResponse, type PeerScalerOrphansResponse, type PeerClusterSettingsRequest, type WorkerClusterSettings, type PeerLogsCollectRequest, type PeerLeaving, type PeerAgentTokenRevoke, type RaftVoteRequest, type RaftVoteResponse, type RaftAppendEntries } from '@kici-dev/engine';
+import { type PeerHeartbeat, type PeerToPeerMessage, type JobReroute, type JobProgress, type JobProgressAck, type PeerScalerEvent, type PeerJobCancel, type PeerLogChunk, type PeerCacheUploadRequest, type PeerCacheUploadResponse, type PeerConfigReload, type PeerConfigReloadResponse, type PeerScalerOrphansRequest, type PeerForgetRequest, type PeerForgetResponse, type PeerScalerOrphansResponse, type PeerClusterSettingsRequest, type WorkerClusterSettings, type PeerLogsCollectRequest, type PeerLeaving, type PeerAgentTokenRevoke, type RaftVoteRequest, type RaftVoteResponse, type RaftAppendEntries, type PeerScalerReloadRequest, type PeerScalerReloadResponse } from '@kici-dev/engine';
 import { type PeerRegistry } from './peer-registry.js';
 import { type PEER_FORGET_TIMEOUT, type PeerForgetRequestHandler } from './peer-forget.js';
 import { type SCALER_ORPHANS_TIMEOUT, type ScalerOrphansRequestHandler } from './scaler-orphans-peer.js';
+import type { PEER_REQUEST_TIMEOUT } from './peer-request-waiters.js';
+import type { ScalerFileReload } from '../scaler/file-reload.js';
 import type { PeerCredentialStore } from './peer-credentials.js';
 import { type JoinTokenManager } from './join-token.js';
 /**
@@ -118,6 +120,13 @@ export interface PeerHandlerDeps {
      * requests are answered with ok=false.
      */
     onScalerOrphansRequest?: ScalerOrphansRequestHandler;
+    /**
+     * Reloads this node's scaler config for a peer.scaler.reload.request
+     * (`kici-admin scaler reload`). A request from a peer that is not a
+     * coordinator is refused before it reaches the handler. If undefined,
+     * requests are answered `rejected`.
+     */
+    onScalerReloadRequest?: ScalerFileReload;
     /**
      * Forgets a departed peer a sibling coordinator forgot (`kici-admin peer
      * forget`). A request from a peer that is not a coordinator is refused. If
@@ -155,6 +164,7 @@ export declare function createPeerHandler(deps: PeerHandlerDeps): {
     sendAndWaitAck: (targetInstanceId: string, msg: JobReroute, timeoutMs?: number) => Promise<boolean>;
     sendConfigReloadAndWait: (targetInstanceId: string, msg: PeerConfigReload, timeoutMs?: number) => Promise<PeerConfigReloadResponse | null>;
     sendScalerOrphansAndWait: (targetInstanceId: string, msg: PeerScalerOrphansRequest, timeoutMs: number) => Promise<PeerScalerOrphansResponse | null | typeof SCALER_ORPHANS_TIMEOUT>;
+    sendScalerReloadAndWait: (targetInstanceId: string, msg: PeerScalerReloadRequest, timeoutMs: number) => Promise<PeerScalerReloadResponse | null | typeof PEER_REQUEST_TIMEOUT>;
     sendPeerForgetAndWait: (targetInstanceId: string, msg: PeerForgetRequest, timeoutMs: number) => Promise<PeerForgetResponse | null | typeof PEER_FORGET_TIMEOUT>;
     sendLogsCollectAndWait: (targetInstanceId: string, msg: PeerLogsCollectRequest, timeoutMs: number) => Promise<Buffer>;
     getConnectionCount: () => number;

package/dist/cluster/peer-request-waiters.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Correlates a peer request with its response by message id. Shared by every
+ * request/response pair the outgoing `PeerClient` and the incoming peer handler
+ * carry, so each pair needs only its response type and its close-time answer.
+ */
+/** A wait that ended without a response. */
+export declare const PEER_REQUEST_TIMEOUT = "timeout";
+/** Pending peer requests of one message pair, keyed by message id. */
+export declare class PeerRequestWaiters<TResponse extends {
+    messageId: string;
+}> {
+    private readonly closedResponse;
+    private readonly waiters;
+    /**
+     * @param closedResponse the answer each pending wait gets when the connection
+     *   closes, built from its message id and the close reason.
+     */
+    constructor(closedResponse: (messageId: string, reason: string) => TResponse);
+    /** Wait for the response to `messageId`, or {@link PEER_REQUEST_TIMEOUT}. */
+    wait(messageId: string, timeoutMs: number): Promise<TResponse | typeof PEER_REQUEST_TIMEOUT>;
+    /** Hand a response to the request waiting for it. An unknown id is dropped. */
+    resolve(response: TResponse): void;
+    /** End every pending wait with the close-time answer naming `reason`. */
+    rejectAll(reason: string): void;
+}
+//# sourceMappingURL=peer-request-waiters.d.ts.map

package/dist/cluster/scaler-orphans-peer.d.ts

@@ -7,6 +7,7 @@
 import { z } from 'zod';
 import type { PeerScalerOrphansRequest, PeerScalerOrphansResponse } from '@kici-dev/engine';
 import type { ScalerOrphansAnswer } from '../scaler/orphan-requests.js';
+import { PeerRequestWaiters } from './peer-request-waiters.js';
 /** Answers a forwarded request from this node's own host and tracking. */
 export type ScalerOrphansRequestHandler = (msg: PeerScalerOrphansRequest) => Promise<ScalerOrphansAnswer>;
 /** The answer of a peer that has no handler wired. */
@@ -27,14 +28,8 @@ export declare const SCALER_ORPHANS_TIMEOUT: "timeout";
  * out its timeout for a peer that cannot answer.
  */
 export declare function replyToScalerOrphansRequest(msg: PeerScalerOrphansRequest, handler: ScalerOrphansRequestHandler | undefined, send: (response: PeerScalerOrphansResponse) => void, logFields?: Record<string, unknown>): void;
-/** Pending scaler orphan requests, keyed by message id. */
-export declare class ScalerOrphansWaiters {
-    private readonly waiters;
-    /** Wait for the response to `messageId`, or {@link SCALER_ORPHANS_TIMEOUT}. */
-    wait(messageId: string, timeoutMs: number): Promise<PeerScalerOrphansResponse | typeof SCALER_ORPHANS_TIMEOUT>;
-    /** Hand a response to the request waiting for it. An unknown id is dropped. */
-    resolve(response: PeerScalerOrphansResponse): void;
-    /** End every pending wait with an `ok: false` response naming `reason`. */
-    rejectAll(reason: string): void;
+/** Pending scaler orphan requests; a close answers each `ok: false` naming the reason. */
+export declare class ScalerOrphansWaiters extends PeerRequestWaiters<PeerScalerOrphansResponse> {
+    constructor();
 }
 //# sourceMappingURL=scaler-orphans-peer.d.ts.map

package/dist/cluster/scaler-reload-fanout.d.ts

@@ -0,0 +1,29 @@
+import { type PeerScalerReloadRequest, type PeerScalerReloadResponse, type ScalerReloadInstanceResult } from '@kici-dev/engine';
+import type { ScalerFileReload } from '../scaler/file-reload.js';
+import type { PeerRegistry } from './peer-registry.js';
+import { PEER_REQUEST_TIMEOUT } from './peer-request-waiters.js';
+/**
+ * Sends one scaler reload request to a peer and waits for its answer. Resolves
+ * null when no connection reached the peer, and {@link PEER_REQUEST_TIMEOUT}
+ * when it did not answer within `timeoutMs`.
+ */
+export type SendScalerReload = (instanceId: string, msg: PeerScalerReloadRequest, timeoutMs: number) => Promise<PeerScalerReloadResponse | null | typeof PEER_REQUEST_TIMEOUT>;
+export interface ScalerReloadAcrossClusterOptions {
+    selfInstanceId: string;
+    selfRole: 'coordinator' | 'worker';
+    registry: Pick<PeerRegistry, 'getAllPeers'>;
+    local: ScalerFileReload;
+    send: SendScalerReload;
+    /** Reload this orchestrator only. */
+    single: boolean;
+    /** How long to wait for each peer's answer. */
+    timeoutMs: number;
+}
+/**
+ * Reload this orchestrator and every peer in its registry. A connected peer
+ * (coordinator or worker) gets the request; a known peer that is not connected
+ * is reported `unreachable` without one. The local reload and the peer
+ * requests run at the same time; the first result is this orchestrator's.
+ */
+export declare function reloadScalersAcrossCluster(opts: ScalerReloadAcrossClusterOptions): Promise<ScalerReloadInstanceResult[]>;
+//# sourceMappingURL=scaler-reload-fanout.d.ts.map

package/dist/cluster/scaler-reload-peer.d.ts

@@ -0,0 +1,16 @@
+import { type PeerScalerReloadRequest, type PeerScalerReloadResponse } from '@kici-dev/engine';
+import type { ScalerFileReload } from '../scaler/file-reload.js';
+import { PeerRequestWaiters } from './peer-request-waiters.js';
+/** The answer to a request a worker sent: a worker never directs another node's scalers. */
+export declare const SCALER_RELOAD_COORDINATORS_ONLY_DETAIL = "scaler reload requests are accepted from coordinators only";
+/**
+ * Answer one request through `send`. A missing handler and a handler failure
+ * are both answered `rejected`, so the requester never waits out its timeout
+ * for a peer that cannot answer.
+ */
+export declare function replyToScalerReloadRequest(msg: PeerScalerReloadRequest, handler: ScalerFileReload | undefined, send: (response: PeerScalerReloadResponse) => void, logFields?: Record<string, unknown>): void;
+/** Pending scaler reload requests; a close answers each `unreachable` naming the reason. */
+export declare class ScalerReloadWaiters extends PeerRequestWaiters<PeerScalerReloadResponse> {
+    constructor();
+}
+//# sourceMappingURL=scaler-reload-peer.d.ts.map

package/dist/cluster/worker-cluster-settings.d.ts

@@ -13,6 +13,7 @@ import type { ClusterSettingsReader } from './cluster-settings-reader.js';
 export interface WorkerClusterSettingDefaults {
     agentTokenTtlMs: number;
     firecrackerApiSocketWaitMs: number;
+    concurrencyWaitTimeoutMs: number;
 }
 /** A worker snapshot and the `cluster_settings.version` its values belong to. */
 export interface WorkerClusterSettingsSnapshot {

package/dist/cold-store/load-access-log-range.d.ts

@@ -14,9 +14,9 @@
  * the hot tuple comparison `(created_at, id) < (cursor.createdAt, cursor.id)`.
  * The cursor also carries a `source: 'hot' | 'cold'` discriminator so a
  * cursor minted while the page boundary was inside cold can resume in
- * the cold stream on the next request. Cursors without a `source` field
- * default to `'hot'` — backwards-compatible with any tab the user had
- * open across a deploy boundary.
+ * the cold stream on the next request. A cursor without a valid `source` is
+ * invalid, like any other unparsable cursor, and the read starts from the
+ * first page.
  */
 import { type Kysely, type Selectable } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';

package/dist/cold-store/tables/access-log.d.ts

@@ -1,15 +1,13 @@
 /**
  * `access_log` cold-store adapter (Orchestrator side).
  *
- *
  * Contract:
  *   - tenant column: `org_id` (NULL → synthetic `__orchestrator__`)
  *   - partition column: `created_at`
  *   - warm TTL: 30 days
  *
- * Replaces the previous 90-day `expires_at`-based hard delete (removed
- * by migration 007). Rows older than 30 days now live in S3
- * indefinitely.
+ * Rows older than 30 days live in S3 indefinitely; there is no
+ * `expires_at`-based hard delete.
  *
  * Synthetic tenant: orchestrator-level access events (e.g. scheduler
  * tick failures, admin-triggered scheduled jobs) carry `org_id IS
@@ -21,20 +19,18 @@
  * audit row per ~50K-row chunk.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdRetention, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdRetention, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { AccessLogTable, Database } from '../../db/types.js';
 export type AccessLogColdStoreRow = Selectable<AccessLogTable>;
 export interface AccessLogAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class AccessLogAdapter implements TableAdapter<AccessLogColdStoreRow> {
-    private readonly kdb;
+export declare class AccessLogAdapter extends PgTableAdapterBase<Database> implements TableAdapter<AccessLogColdStoreRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "access_log";
     readonly tenantColumn = "org_id";
     readonly partitionColumn = "created_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: AccessLogAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -43,10 +39,6 @@ export declare class AccessLogAdapter implements TableAdapter<AccessLogColdStore
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/event-log.d.ts

@@ -7,34 +7,27 @@
  *   - partition column: `received_at`
  *   - warm TTL: 30 days (rows are archived, not hard-deleted)
  *
- * Per-row payload retention: rows on this table carry a `payload_key`
- * pointing at a gzipped webhook body in object storage (LogStorage).
- * Cold-store packages the row metadata — including `payload_key` —
- * but does NOT touch the body the key points to. The body remains in
- * S3 indefinitely so the dashboard delivery-detail page resolves
- * payload reads identically for hot and cold rows. Nothing deletes the
- * row and the payload blob in lock-step.
+ * Each row's `payload_key` points at a gzipped webhook body in object
+ * storage. Archiving moves the row, `payload_key` included, and leaves the
+ * body where it is, so the delivery-detail page reads payloads the same way
+ * for hot and cold rows.
  *
- * Recursive write: archiving event_log rows writes one access_log
- * audit row per chunk (the orchestrator's audit surface). The new
- * access_log rows themselves get archived in a later cycle by the
- * AccessLogAdapter, bounded.
+ * Each archived chunk writes one `access_log` audit row, which the
+ * AccessLogAdapter archives in a later cycle.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, EventLogTable } from '../../db/types.js';
 export type EventLogColdStoreRow = Selectable<EventLogTable>;
 export interface EventLogAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class EventLogAdapter implements TableAdapter<EventLogColdStoreRow> {
-    private readonly kdb;
+export declare class EventLogAdapter extends PgTableAdapterBase<Database> implements TableAdapter<EventLogColdStoreRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "event_log";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "received_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: EventLogAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -43,10 +36,6 @@ export declare class EventLogAdapter implements TableAdapter<EventLogColdStoreRo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/execution-jobs.d.ts

@@ -1,39 +1,26 @@
 /**
  * `execution_jobs` cold-store adapter (Orchestrator side).
  *
+ * Tenant column `routing_key`, partition column `created_at`, warm TTL 30
+ * days. Eligible: a terminal job with no live step rows for its (run, job).
  *
- * Contract:
- *   - tenant column: `routing_key` (denormalized in migration 006)
- *   - partition column: `created_at`
- *   - warm TTL: 30 days
- *   - eligibility: terminal job status AND no live steps remain for this
- *     (run, job)
- *
- * Order: registered AFTER `ExecutionStepsAdapter`, BEFORE
- * `ExecutionRunsAdapter` (within one cycle: steps → jobs → runs). The
- * "no live steps" predicate makes the ordering self-correcting across
- * cycle interruptions.
- *
- * FK ordering on the orchestrator side: `execution_jobs.run_id` is a
- * FK to `execution_runs(run_id)`. Deleting a job is safe from the FK's
- * perspective (the FK only constrains job → run direction). The runs
- * adapter's eligibility predicate handles the dependent-rows check.
+ * Registered between the steps and runs adapters (steps → jobs → runs).
+ * Deleting a job never trips the `execution_jobs.run_id → execution_runs`
+ * FK; the runs adapter skips runs that still have jobs.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, ExecutionJobTable } from '../../db/types.js';
 export type ExecutionJobRow = Selectable<ExecutionJobTable>;
 export interface ExecutionJobsAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class ExecutionJobsAdapter implements TableAdapter<ExecutionJobRow> {
-    private readonly kdb;
+export declare class ExecutionJobsAdapter extends PgTableAdapterBase<Database> implements TableAdapter<ExecutionJobRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "execution_jobs";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "created_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: ExecutionJobsAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -42,10 +29,6 @@ export declare class ExecutionJobsAdapter implements TableAdapter<ExecutionJobRo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/execution-runs.d.ts

@@ -1,34 +1,24 @@
 /**
  * `execution_runs` cold-store adapter (Orchestrator side).
  *
- *
- * Contract:
- *   - tenant column: `routing_key`
- *   - partition column: `created_at`
- *   - warm TTL: 30 days
- *   - eligibility: terminal run status AND no live jobs reference this run
- *
- * Order: registered LAST in the orchestrator cold-store. Within one
- * cycle the framework iterates adapters steps → jobs → runs; this
- * adapter goes last so the FK `execution_jobs.run_id →
- * execution_runs(run_id)` doesn't fire on DELETE. The "no live jobs"
- * predicate enforces the same invariant across cycle interruptions.
+ * Tenant column `routing_key`, partition column `created_at`, warm TTL 30
+ * days. Eligible: a terminal run that no live job references. Registered
+ * last (steps → jobs → runs) so the `execution_jobs.run_id` FK never fires
+ * on DELETE.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, ExecutionRunTable } from '../../db/types.js';
 export type ExecutionRunRow = Selectable<ExecutionRunTable>;
 export interface ExecutionRunsAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class ExecutionRunsAdapter implements TableAdapter<ExecutionRunRow> {
-    private readonly kdb;
+export declare class ExecutionRunsAdapter extends PgTableAdapterBase<Database> implements TableAdapter<ExecutionRunRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "execution_runs";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "created_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: ExecutionRunsAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -37,10 +27,6 @@ export declare class ExecutionRunsAdapter implements TableAdapter<ExecutionRunRo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/execution-steps.d.ts

@@ -1,41 +1,27 @@
 /**
  * `execution_steps` cold-store adapter (Orchestrator side).
  *
+ * Tenant column `routing_key`, partition column `created_at`, warm TTL 30
+ * days. Steps are append-only, so age alone makes a row eligible.
  *
- * Contract:
- *   - tenant column: `routing_key` (denormalized in migration 006)
- *   - partition column: `created_at`
- *   - warm TTL: 30 days
- *   - eligibility: created_at < cutoff (steps are append-only and have no
- *     terminal-status predicate — there is no UPDATE statement against
- *     `execution_steps` in the orchestrator codebase, so age alone is
- *     sufficient)
- *
- * Order: registered FIRST in the orchestrator cold-store. Within one
- * cycle the framework iterates adapters in registration order
- * (steps → jobs → runs); steps go first so the FK chain
- * (execution_jobs.run_id → execution_runs.run_id) doesn't break when
- * jobs and runs are archived later.
- *
- * Audit emission: orchestrator-side adapters write to `access_log`
- * (the orchestrator's audit surface; `audit_log` is Platform-side only).
- * The row uses actor_type='system', actor_id='cold-store-archive:<id>'.
+ * Registered first: the framework archives in registration order (steps →
+ * jobs → runs), which keeps the `execution_jobs.run_id → execution_runs` FK
+ * chain intact. The archive audit row goes to `access_log`, the
+ * orchestrator's audit surface, as actor `cold-store-archive:<instanceId>`.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, ExecutionStepTable } from '../../db/types.js';
 export type ExecutionStepRow = Selectable<ExecutionStepTable>;
 export interface ExecutionStepsAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class ExecutionStepsAdapter implements TableAdapter<ExecutionStepRow> {
-    private readonly kdb;
+export declare class ExecutionStepsAdapter extends PgTableAdapterBase<Database> implements TableAdapter<ExecutionStepRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "execution_steps";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "created_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: ExecutionStepsAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -44,10 +30,6 @@ export declare class ExecutionStepsAdapter implements TableAdapter<ExecutionStep
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/secret-audit-log.d.ts

@@ -1,12 +1,11 @@
 /**
  * `secret_audit_log` cold-store adapter (Orchestrator side).
  *
- *
  * Contract:
  *   - tenant column: `routing_key` (NULL → synthetic `__orchestrator__`)
  *   - partition column: `timestamp`
- *   - warm TTL: 90 days (longer window than other audit tables — volume is
- *     low, forensic value is high)
+ *   - warm TTL: `minSecretAuditLogWarmDays()` table-wide, tightened per row
+ *     by `secretAuditLogWarmSqlCase()`
  *
  * Synthetic tenant: rows without `routing_key` (e.g. orchestrator-level
  * key rotations done before any source is bound) collapse to a single
@@ -14,21 +13,19 @@
  * used for `event_log` payload keys when the routing key is missing.
  */
 import { type Kysely } from 'kysely';
-import { type ChunkCommitMetadata, type ColdRetention, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdRetention, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, SecretAuditLogRow } from '../../db/types.js';
 /** Re-exported rather than re-declared — see the note in `load-event-log-range`. */
 export type { SecretAuditLogRow };
 export interface SecretAuditLogAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class SecretAuditLogAdapter implements TableAdapter<SecretAuditLogRow> {
-    private readonly kdb;
+export declare class SecretAuditLogAdapter extends PgTableAdapterBase<Database> implements TableAdapter<SecretAuditLogRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "secret_audit_log";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "timestamp";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: SecretAuditLogAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -37,10 +34,6 @@ export declare class SecretAuditLogAdapter implements TableAdapter<SecretAuditLo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/config/env-overlay.d.ts

@@ -3,20 +3,15 @@
  *
  * Converts KICI_-prefixed env vars to nested config paths and applies
  * them as overrides on top of a config object.
- *
- * Multi-app env var convention:
- * - App name in YAML: `main-org` -> env segment: `MAIN_ORG` (hyphen to underscore, uppercased)
- * - Example: KICI_PROVIDERS_GITHUB_MAIN_ORG_APP_ID -> providers.github[name=main-org].appId
  */
 /**
  * Convert a KICI_ env var key to a config path array.
  * Returns null for non-KICI_ keys or unknown mappings.
  *
  * Handles three patterns:
- * 1. Direct mappings (KICI_DATABASE_URL -> ['database', 'url'])
- * 2. Startup names whose overlay spelling differs (KICI_PORT -> ['server', 'port'])
- * 3. Multi-app GitHub provider (KICI_PROVIDERS_GITHUB_<NAME>_<FIELD> ->
- *    ['providers', 'github', '<name-lowered>', '<camelField>'])
+ * 1. Unprefixed names the startup loader reads (NODE_ENV -> ['nodeEnv'])
+ * 2. Direct mappings (KICI_DATABASE_URL -> ['database', 'url'])
+ * 3. Startup names whose overlay spelling differs (KICI_PORT -> ['server', 'port'])
  */
 export declare function envKeyToConfigPath(key: string): string[] | null;
 /**