@kici-dev/orchestrator 0.18.0 → 0.20.0

package/dist/standalone.js

@@ -5,7 +5,7 @@ __cjs_dirname(__filename);
 import "node:module";
 import "@kici-dev/shared/load-service-env-file";
 import { AgentDeliveryMode, AgentPlatform, BaseColdStore, ChunkLru, ChunkRequestWaiter, CommandError, PgTableAdapterBase, addLogsToArchive, applyProxyKeepAliveTimeouts, chunkBuffer, closeDatabase, computeBackoffDelay, computeMigrationsHash, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, decrypt, decryptJson, depCacheKeyOf, deriveKey, encodeKeySegment, encrypt, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, isPgUniqueViolation, logger, parseDatabaseUrl, redactConfig, requestContext, retryOnBrokenConnection, serializeError, setServiceName, setupGracefulShutdown, shQuote, sha256, stderrTail, stopHttpServer, storeMigrationContentHash, toCommandError, toErrorMessage, trackOpenSockets, validateRequiredTools } from "@kici-dev/shared";
-import { ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_FEATURE_LABELS, ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CONTAINER_BUILD_RUNTIME_LABEL, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostWriteRefusal, ForkPolicy, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, ID_TOKEN_CLAIM_NAMES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INVALID_JOIN_REQUEST_MESSAGE, InitFailureCategory, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JobRejectReason, JoinErrorCode, JoinRequestKind, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MinimumTrustSchema, ORCH_AGENT_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchRole, OrchestratorMode, PEER_MUTUAL_AUTH_REQUIRED_REASON, PLATFORM_CONNECTED_MODES, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, RegisterableTriggerType, RunFailureClass, RuntimeFact, SCALER_EVENT_NAMES, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScaleDownReason, ScaleDownReason as ScaleDownReason$1, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, ScalerOrphansAction, ScalerReloadOutcome, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, SetupStepType, SourceOrigin, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_TYPES, TimeoutReason, TraceCheck, TriggerSource, TrustTierSchema, UnavailablePathsTrace, VariantKind, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, appendChecks, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidSecretKey, attestationVerifyStatusSchema, buildEventClaims, buildIdTokenSubject, buildJoinRefusal, buildTrustedPassthroughEnv, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, checkArtifactName, classifyJoinRequest, coerceDispatchInputs, collectDiscriminatorTypes, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createWorkflowDecision, deriveOsArchLabels, diffRangeKindSchema, fanoutEnvelopeFields, flattenActor, formatLabelMatcher, getAccessLogColdDays, getSecretAuditLogColdDays, githubIngressPath, githubWebhookPath, globalEvalRoundResultSchema, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, installGateJobId, isFailureStatus, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOsArchLabels, platformToTaints, reservedEventNamePrefix, resolveDiffRange, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, resourceRequestNestedSchema, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, sleep, stringifyActor, testRelayTriggerRequestSchema, testRelayUploadsInitRequestSchema, toIsoString, truncateDecisionsToByteBudget, trustPolicyUpdateSchema, trustedContributorHoldReason, validateScopeName, validateSecretKey, wrapUntrusted } from "@kici-dev/engine";
+import { ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_FEATURE_LABELS, ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CONTAINER_BUILD_RUNTIME_LABEL, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostWriteRefusal, ForkPolicy, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, ID_TOKEN_CLAIM_NAMES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INVALID_JOIN_REQUEST_MESSAGE, InitFailureCategory, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JobRejectReason, JoinErrorCode, JoinRequestKind, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MinimumTrustSchema, ORCH_AGENT_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchRole, OrchestratorMode, PEER_MUTUAL_AUTH_REQUIRED_REASON, PLATFORM_CONNECTED_MODES, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, RegisterableTriggerType, RunFailureClass, RuntimeFact, SCALER_EVENT_NAMES, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScaleDownReason, ScaleDownReason as ScaleDownReason$1, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, ScalerOrphansAction, ScalerReloadOutcome, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, SetupStepType, SourceOrigin, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TEST_RUN_LOG_CURSOR_START, TRIGGER_EVENT_TYPES, TimeoutReason, TraceCheck, TriggerSource, TrustTierSchema, UnavailablePathsTrace, VariantKind, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, appendChecks, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidSecretKey, attestationVerifyStatusSchema, buildEventClaims, buildIdTokenSubject, buildJoinRefusal, buildTrustedPassthroughEnv, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, checkArtifactName, classifyJoinRequest, coerceDispatchInputs, collectDiscriminatorTypes, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createWorkflowDecision, deriveOsArchLabels, diffRangeKindSchema, fanoutEnvelopeFields, flattenActor, formatLabelMatcher, getAccessLogColdDays, getSecretAuditLogColdDays, githubIngressPath, githubWebhookPath, globalEvalRoundResultSchema, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, installGateJobId, isFailureStatus, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOsArchLabels, platformToTaints, reservedEventNamePrefix, resolveDiffRange, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, resourceRequestNestedSchema, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, sleep, stringifyActor, testRelayTriggerRequestSchema, testRelayUploadsInitRequestSchema, toIsoString, truncateDecisionsToByteBudget, truncateReasonText, trustPolicyUpdateSchema, trustedContributorHoldReason, validateScopeName, validateSecretKey, wrapUntrusted } from "@kici-dev/engine";
 import { z } from "zod";
 import { X509Certificate, createCipheriv, createDecipheriv, createHash, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { sql } from "kysely";
@@ -394,9 +394,9 @@ function clusterSentinelKey(prefix) {
 	const trimmed = prefix.replace(/\/+$/, "");
 	return trimmed.length === 0 ? ".kici-cluster-id" : `${trimmed}/.kici-cluster-id`;
 }
-var logger$166, ClusterIdentity;
+var logger$167, ClusterIdentity;
 var init_cluster_identity = __esmMin((() => {
-	logger$166 = createLogger({ prefix: "cluster-identity" });
+	logger$167 = createLogger({ prefix: "cluster-identity" });
 	ClusterIdentity = class {
 		deps;
 		constructor(deps) {
@@ -415,11 +415,11 @@ var init_cluster_identity = __esmMin((() => {
 		*/
 		async validateS3Sentinel() {
 			if (!this.deps.s3Client || !this.deps.storageBucket) {
-				logger$166.debug("S3 not configured, skipping sentinel validation");
+				logger$167.debug("S3 not configured, skipping sentinel validation");
 				return;
 			}
 			if (this.deps.skipSentinelValidation) {
-				logger$166.warn("Skipping S3 sentinel validation (KICI_SKIP_S3_SENTINEL_VALIDATION=true)");
+				logger$167.warn("Skipping S3 sentinel validation (KICI_SKIP_S3_SENTINEL_VALIDATION=true)");
 				return;
 			}
 			const clusterId = await this.getClusterId();
@@ -427,7 +427,7 @@ var init_cluster_identity = __esmMin((() => {
 			const existing = await this.deps.s3Client.getObject(this.deps.storageBucket, sentinelKey);
 			if (existing === null) {
 				await this.deps.s3Client.putObject(this.deps.storageBucket, sentinelKey, clusterId);
-				logger$166.info("Wrote cluster identity sentinel to S3", {
+				logger$167.info("Wrote cluster identity sentinel to S3", {
 					clusterId,
 					bucket: this.deps.storageBucket,
 					sentinelKey
@@ -435,7 +435,7 @@ var init_cluster_identity = __esmMin((() => {
 				return;
 			}
 			if (existing.trim() !== clusterId) throw new Error(`Cluster identity mismatch: this orchestrator's database does not match the target pool. DB cluster_id=${clusterId}, S3 sentinel=${existing.trim()} (s3://${this.deps.storageBucket}/${sentinelKey}). Verify database connection configuration, or set KICI_STORAGE_PREFIX to isolate this cluster's sentinel.`);
-			logger$166.debug("S3 sentinel matches cluster_id", {
+			logger$167.debug("S3 sentinel matches cluster_id", {
 				clusterId,
 				sentinelKey
 			});
@@ -446,7 +446,7 @@ var init_cluster_identity = __esmMin((() => {
 		*/
 		async validateAtStartup(instanceId) {
 			const clusterId = await this.getClusterId();
-			logger$166.info("Cluster identity validated", {
+			logger$167.info("Cluster identity validated", {
 				clusterId,
 				instanceId
 			});
@@ -1419,7 +1419,7 @@ var init_config$5 = __esmMin((() => {
 */
 function configureJobSecretSealing(keys) {
 	sealingKeys = keys;
-	if (keys === null) logger$165.warn("KICI_SECRET_KEY is not set: the secrets of queued and waiting jobs are stored unencrypted in the orchestrator database. Set KICI_SECRET_KEY (or KICI_SECRET_KEY_FILE) to encrypt them with the orchestrator master key.");
+	if (keys === null) logger$166.warn("KICI_SECRET_KEY is not set: the secrets of queued and waiting jobs are stored unencrypted in the orchestrator database. Set KICI_SECRET_KEY (or KICI_SECRET_KEY_FILE) to encrypt them with the orchestrator master key.");
 }
 /** The AAD a stored job's sealed secrets are bound to. */
 function jobSecretsAad(runId) {
@@ -1482,9 +1482,9 @@ function unsealJobConfig(runId, jobConfig, sealed) {
 		...secret
 	};
 }
-var logger$165, SEALED_JOB_CONFIG_KEYS, JobSecretsUnsealError, sealingKeys;
+var logger$166, SEALED_JOB_CONFIG_KEYS, JobSecretsUnsealError, sealingKeys;
 var init_job_secret_seal = __esmMin((() => {
-	logger$165 = createLogger({ prefix: "job-secret-seal" });
+	logger$166 = createLogger({ prefix: "job-secret-seal" });
 	SEALED_JOB_CONFIG_KEYS = [
 		"secrets",
 		"namespacedSecrets",
@@ -1529,10 +1529,10 @@ async function liveInstanceIds(db, instanceIds, graceMs) {
 	const rows = await db.selectFrom("cluster_instances").select(["instance_id"]).where("instance_id", "in", unique).where("last_heartbeat_at", ">", cutoff).execute();
 	return new Set(rows.map((r) => r.instance_id));
 }
-var logger$164, DEFAULT_INSTANCE_HEARTBEAT_MS, InstanceHeartbeat;
+var logger$165, DEFAULT_INSTANCE_HEARTBEAT_MS, InstanceHeartbeat;
 var init_instance_heartbeat = __esmMin((() => {
 	init_run_detached();
-	logger$164 = createLogger({ prefix: "instance-heartbeat" });
+	logger$165 = createLogger({ prefix: "instance-heartbeat" });
 	DEFAULT_INSTANCE_HEARTBEAT_MS = 1e4;
 	InstanceHeartbeat = class {
 		db;
@@ -1556,10 +1556,10 @@ var init_instance_heartbeat = __esmMin((() => {
 		async start() {
 			await this.beat({ processStart: true });
 			this.timer = setInterval(() => {
-				runDetached(logger$164, "Coordinator heartbeat", () => this.beat(), { instanceId: this.instanceId });
+				runDetached(logger$165, "Coordinator heartbeat", () => this.beat(), { instanceId: this.instanceId });
 			}, this.intervalMs);
 			this.timer.unref?.();
-			logger$164.info("Coordinator heartbeat started", {
+			logger$165.info("Coordinator heartbeat started", {
 				instanceId: this.instanceId,
 				intervalMs: this.intervalMs
 			});
@@ -1579,7 +1579,7 @@ var init_instance_heartbeat = __esmMin((() => {
 			try {
 				await this.db.deleteFrom("cluster_instances").where("instance_id", "=", this.instanceId).execute();
 			} catch (err) {
-				logger$164.warn("Coordinator heartbeat retire failed", {
+				logger$165.warn("Coordinator heartbeat retire failed", {
 					instanceId: this.instanceId,
 					error: toErrorMessage(err)
 				});
@@ -1607,7 +1607,7 @@ var init_instance_heartbeat = __esmMin((() => {
 					...opts.processStart === true ? { started_at: now } : {}
 				})).execute();
 			} catch (err) {
-				logger$164.warn("Coordinator heartbeat write failed", {
+				logger$165.warn("Coordinator heartbeat write failed", {
 					instanceId: this.instanceId,
 					error: toErrorMessage(err)
 				});
@@ -1788,9 +1788,9 @@ function parseSelectorColumnForExpiry(v, column) {
 	if (typeof v === "string") try {
 		const parsed = JSON.parse(v);
 		if (Array.isArray(parsed)) return parsed;
-		logger$163.warn("dispatch_queue selector column is not a JSON array", { column });
+		logger$164.warn("dispatch_queue selector column is not a JSON array", { column });
 	} catch {
-		logger$163.warn("dispatch_queue selector column holds malformed JSON", { column });
+		logger$164.warn("dispatch_queue selector column holds malformed JSON", { column });
 	}
 	return [];
 }
@@ -1805,13 +1805,13 @@ function jobPatternsSatisfiedBy(job, labels) {
 	if (job.excludePatterns.some((p) => matcherSatisfiedBy(p, labels))) return false;
 	return true;
 }
-var logger$163, OWNER_COLUMN, STOPPED_RUN_DISPATCH_REASON, MAX_DEFERRED_UNOPENABLE, TERMINAL_DISPATCH_STATUSES, JobQueue;
+var logger$164, OWNER_COLUMN, STOPPED_RUN_DISPATCH_REASON, MAX_DEFERRED_UNOPENABLE, TERMINAL_DISPATCH_STATUSES, JobQueue;
 var init_job_queue = __esmMin((() => {
 	init_agent_fit();
 	init_config$5();
 	init_job_secret_seal();
 	init_instance_heartbeat();
-	logger$163 = createLogger({ prefix: "job-queue" });
+	logger$164 = createLogger({ prefix: "job-queue" });
 	OWNER_COLUMN = "dispatch_queue.owner_instance_id";
 	STOPPED_RUN_DISPATCH_REASON = "the run stopped before this job was dispatched";
 	MAX_DEFERRED_UNOPENABLE = 1e3;
@@ -2224,7 +2224,7 @@ var init_job_queue = __esmMin((() => {
 				inserted: false
 			};
 			if (await this.expireDispatchOfStoppedRun(id, job.runId)) {
-				logger$163.info("Direct dispatch refused: the run has stopped", {
+				logger$164.info("Direct dispatch refused: the run has stopped", {
 					runId: job.runId,
 					jobId: id
 				});
@@ -2250,7 +2250,7 @@ var init_job_queue = __esmMin((() => {
 		*/
 		async settleClaimOfStoppedRun(id, runId) {
 			const settled = await this.expireDispatchOfStoppedRun(id, runId);
-			if (settled) logger$163.info("Claimed job settled: its run stopped before it was put back", {
+			if (settled) logger$164.info("Claimed job settled: its run stopped before it was put back", {
 				runId,
 				jobId: id
 			});
@@ -3358,7 +3358,7 @@ async function rejectPending(store, hold, reason) {
 	try {
 		return await store.reject(hold.org_id, hold.id, reason);
 	} catch (err) {
-		logger$162.info("Cancel of a held run lost the hold to a decision", {
+		logger$163.info("Cancel of a held run lost the hold to a decision", {
 			runId: hold.run_id,
 			heldRunId: hold.id,
 			error: toErrorMessage(err)
@@ -3375,7 +3375,7 @@ async function withdrawWorkflowHold(deps, hold, reason, terminalWrite) {
 	try {
 		await deps.rejectHeldWorkflow(hold, reason, { runHeld: terminalWrite });
 	} catch (err) {
-		logger$162.error("Failed to withdraw a held run after its hold was rejected by a cancel", {
+		logger$163.error("Failed to withdraw a held run after its hold was rejected by a cancel", {
 			runId: hold.run_id,
 			heldRunId: hold.id,
 			error: toErrorMessage(err)
@@ -3383,10 +3383,10 @@ async function withdrawWorkflowHold(deps, hold, reason, terminalWrite) {
 		if (terminalWrite) await deps.executionTracker.cancelHeldRun(hold.run_id, reason);
 	}
 }
-var logger$162;
+var logger$163;
 var init_cancel_held_run = __esmMin((() => {
 	init_held_runs();
-	logger$162 = createLogger({ prefix: "cancel-held-run" });
+	logger$163 = createLogger({ prefix: "cancel-held-run" });
 }));
 //#endregion
 //#region src/cancel/cancel-run.ts
@@ -3415,7 +3415,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 	const force = options.force ?? false;
 	const runRow = await db.selectFrom("execution_runs").select(["status"]).where("run_id", "=", runId).executeTakeFirst();
 	if (runRow && TERMINAL_RUN_STATES.has(runRow.status)) {
-		logger$161.info("Cancel ignored: run already terminal", {
+		logger$162.info("Cancel ignored: run already terminal", {
 			runId,
 			status: runRow.status
 		});
@@ -3433,7 +3433,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 			rejectHeldWorkflow: deps.rejectHeldWorkflow
 		}, runId, reason);
 		if (withdrawal !== "withdrawn") {
-			logger$161.info("Cancel refused: a decision reached the held run first", {
+			logger$162.info("Cancel refused: a decision reached the held run first", {
 				runId,
 				decision: withdrawal
 			});
@@ -3446,7 +3446,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 			};
 		}
 		await stampWithdrawnAttribution(db, runId, options);
-		logger$161.info("Cancelled held run", { runId });
+		logger$162.info("Cancelled held run", { runId });
 		return {
 			agentsNotified: 0,
 			unreachable: 0,
@@ -3482,7 +3482,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 		}
 		unreachable++;
 		stillUnwinding.add(jobId);
-		logger$161.warn("Cancel could not reach the coordinator that owns this job", {
+		logger$162.warn("Cancel could not reach the coordinator that owns this job", {
 			runId,
 			jobId,
 			ownerInstanceId
@@ -3516,7 +3516,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 		await executionTracker.completeRunIfAllJobsTerminal(runId);
 		await executionTracker.cancelJoblessRun(runId, reason);
 	}
-	logger$161.info("Cancelled run", {
+	logger$162.info("Cancelled run", {
 		runId,
 		agentsNotified,
 		unreachable,
@@ -3544,7 +3544,7 @@ async function withdrawPendingHoldsOfActiveRun(deps, runId, reason) {
 		executionTracker: deps.executionTracker,
 		rejectHeldWorkflow: deps.rejectHeldWorkflow
 	}, runId, reason, { terminalWrite: false });
-	logger$161.info("Withdrew the pending approval requests of a cancelled run", {
+	logger$162.info("Withdrew the pending approval requests of a cancelled run", {
 		runId,
 		withdrawn: withdrawal === "withdrawn",
 		...withdrawal !== "withdrawn" && { decision: withdrawal }
@@ -3633,7 +3633,7 @@ function sendLocalCancel(args) {
 		}));
 		return true;
 	} catch (err) {
-		logger$161.warn("Failed to send job.cancel to agent; treating job as orphaned", {
+		logger$162.warn("Failed to send job.cancel to agent; treating job as orphaned", {
 			runId,
 			jobId,
 			agentId,
@@ -3642,12 +3642,12 @@ function sendLocalCancel(args) {
 		return false;
 	}
 }
-var logger$161, RUN_RESUMING_AFTER_APPROVAL_MESSAGE, RUN_REJECTED_BEFORE_CANCEL_MESSAGE, RUN_EXPIRED_BEFORE_CANCEL_MESSAGE, REFUSAL_MESSAGES;
+var logger$162, RUN_RESUMING_AFTER_APPROVAL_MESSAGE, RUN_REJECTED_BEFORE_CANCEL_MESSAGE, RUN_EXPIRED_BEFORE_CANCEL_MESSAGE, REFUSAL_MESSAGES;
 var init_cancel_run = __esmMin((() => {
 	init_instance_heartbeat();
 	init_held_runs();
 	init_cancel_held_run();
-	logger$161 = createLogger({ prefix: "cancel-run" });
+	logger$162 = createLogger({ prefix: "cancel-run" });
 	RUN_RESUMING_AFTER_APPROVAL_MESSAGE = "Run is resuming after approval; cancel it again once it is running";
 	RUN_REJECTED_BEFORE_CANCEL_MESSAGE = "Run was rejected before the cancel reached it; the rejection ends it";
 	RUN_EXPIRED_BEFORE_CANCEL_MESSAGE = "Run approval request expired before the cancel reached it; the expiry ends it";
@@ -3849,7 +3849,7 @@ async function answerScalerOrphansRequest(manager, req) {
 			}))
 		};
 		const results = await manager.stopUntrackedVms(req.vmIds);
-		for (const result of results) logger$160.info("scaler orphan stop result", {
+		for (const result of results) logger$161.info("scaler orphan stop result", {
 			vmId: result.vmId,
 			outcome: result.outcome,
 			pid: result.pid,
@@ -3861,7 +3861,7 @@ async function answerScalerOrphansRequest(manager, req) {
 			results
 		};
 	} catch (err) {
-		logger$160.error("scaler orphan request failed", {
+		logger$161.error("scaler orphan request failed", {
 			action: req.action,
 			error: toErrorMessage(err)
 		});
@@ -3871,9 +3871,9 @@ async function answerScalerOrphansRequest(manager, req) {
 		};
 	}
 }
-var logger$160, MAX_SCALER_ORPHANS_TIMEOUT_MS;
+var logger$161, MAX_SCALER_ORPHANS_TIMEOUT_MS;
 var init_orphan_requests = __esmMin((() => {
-	logger$160 = createLogger({ prefix: "scaler-orphans" });
+	logger$161 = createLogger({ prefix: "scaler-orphans" });
 	MAX_SCALER_ORPHANS_TIMEOUT_MS = 24e4;
 }));
 //#endregion
@@ -4968,12 +4968,12 @@ function adopterIsLive(peer, nowMs, flapGraceMs) {
 function clusterViewSufficient(knownCoordinatorPeerCount, connectedCoordinatorPeerCount) {
 	return knownCoordinatorPeerCount === 0 || connectedCoordinatorPeerCount > 0;
 }
-var logger$159, PROVISION_OUTCOME_RETENTION_MS, EventProvisionReaper;
+var logger$160, PROVISION_OUTCOME_RETENTION_MS, EventProvisionReaper;
 var init_event_provision_reaper = __esmMin((() => {
 	init_prometheus();
 	init_scaler_events();
 	init_run_detached();
-	logger$159 = createLogger({ prefix: "event-provision-reaper" });
+	logger$160 = createLogger({ prefix: "event-provision-reaper" });
 	PROVISION_OUTCOME_RETENTION_MS = 864e5;
 	EventProvisionReaper = class {
 		opts;
@@ -5023,7 +5023,7 @@ var init_event_provision_reaper = __esmMin((() => {
 		}
 		onBecomeLeader() {
 			this.isLeader = true;
-			logger$159.info("Became leader, starting event-provision reaper", { intervalMs: this.opts.bootIntervalMs });
+			logger$160.info("Became leader, starting event-provision reaper", { intervalMs: this.opts.bootIntervalMs });
 			this.schedule(this.opts.bootIntervalMs);
 		}
 		onLoseLeadership() {
@@ -5039,7 +5039,7 @@ var init_event_provision_reaper = __esmMin((() => {
 			this.unknownOwnerLogged.clear();
 			this.unseenPastGrace = 0;
 			this.publishGauges(false);
-			logger$159.info("Lost leadership, stopped event-provision reaper");
+			logger$160.info("Lost leadership, stopped event-provision reaper");
 		}
 		stop() {
 			this.onLoseLeadership();
@@ -5058,7 +5058,7 @@ var init_event_provision_reaper = __esmMin((() => {
 			try {
 				windows = await this.opts.resolveWindows();
 			} catch (err) {
-				logger$159.error("event-provision reap tick could not resolve its windows", { error: toErrorMessage(err) });
+				logger$160.error("event-provision reap tick could not resolve its windows", { error: toErrorMessage(err) });
 				this.publishGauges(false);
 				return;
 			}
@@ -5074,7 +5074,7 @@ var init_event_provision_reaper = __esmMin((() => {
 		async reapProvisions(windows) {
 			if (!this.opts.canReap()) {
 				if (!this.reapBlocked) {
-					logger$159.warn("Skipping event-provision reap: this coordinator is connected to none of the coordinator peers it knows");
+					logger$160.warn("Skipping event-provision reap: this coordinator is connected to none of the coordinator peers it knows");
 					this.reapBlocked = true;
 				}
 				this.strandedSince.clear();
@@ -5096,7 +5096,7 @@ var init_event_provision_reaper = __esmMin((() => {
 			try {
 				candidates = await this.opts.listCandidates(new Date(now - windows.spawnTimeoutMs));
 			} catch (err) {
-				logger$159.error("event-provision reap tick failed to list candidates", { error: toErrorMessage(err) });
+				logger$160.error("event-provision reap tick failed to list candidates", { error: toErrorMessage(err) });
 				return;
 			}
 			if (!this.isLeader) return;
@@ -5121,14 +5121,14 @@ var init_event_provision_reaper = __esmMin((() => {
 				if (!reason) continue;
 				const lastAttempt = this.lastAttemptAt.get(candidate.agentId);
 				if (lastAttempt !== void 0 && now - lastAttempt < windows.reattemptIntervalMs) {
-					logger$159.debug("Skipping a stranded provision still inside its re-attempt window", {
+					logger$160.debug("Skipping a stranded provision still inside its re-attempt window", {
 						agentId: candidate.agentId,
 						scalerName: candidate.scalerName,
 						reason
 					});
 					continue;
 				}
-				logger$159.warn("Reaping stranded event-scaler provision", {
+				logger$160.warn("Reaping stranded event-scaler provision", {
 					agentId: candidate.agentId,
 					scalerName: candidate.scalerName,
 					reason,
@@ -5139,7 +5139,7 @@ var init_event_provision_reaper = __esmMin((() => {
 				try {
 					await this.opts.emitScaleDown(candidate, reason);
 				} catch (err) {
-					logger$159.error("Failed to tear down a stranded event-scaler provision", {
+					logger$160.error("Failed to tear down a stranded event-scaler provision", {
 						agentId: candidate.agentId,
 						scalerName: candidate.scalerName,
 						error: toErrorMessage(err)
@@ -5164,9 +5164,9 @@ var init_event_provision_reaper = __esmMin((() => {
 		async purgeClaims(retentionMs) {
 			try {
 				const purged = await this.opts.purgeExpiredClaims(new Date(Date.now() - retentionMs));
-				if (purged > 0) logger$159.info("Purged expired scaler provisioning claims", { purged });
+				if (purged > 0) logger$160.info("Purged expired scaler provisioning claims", { purged });
 			} catch (err) {
-				logger$159.error("event-provision claim purge failed", { error: toErrorMessage(err) });
+				logger$160.error("event-provision claim purge failed", { error: toErrorMessage(err) });
 			}
 		}
 		/**
@@ -5188,9 +5188,9 @@ var init_event_provision_reaper = __esmMin((() => {
 			const retentionMs = Math.max(PROVISION_OUTCOME_RETENTION_MS, 2 * spawnTimeoutMs);
 			try {
 				const purged = await this.opts.purgeProvisionOutcomes(new Date(Date.now() - retentionMs));
-				if (purged > 0) logger$159.info("Purged expired scaler provision outcomes", { purged });
+				if (purged > 0) logger$160.info("Purged expired scaler provision outcomes", { purged });
 			} catch (err) {
-				logger$159.error("event-provision outcome purge failed", { error: toErrorMessage(err) });
+				logger$160.error("event-provision outcome purge failed", { error: toErrorMessage(err) });
 			}
 		}
 		/**
@@ -5204,11 +5204,11 @@ var init_event_provision_reaper = __esmMin((() => {
 		reconcileInterval(intervalMs) {
 			if (!this.isLeader) return;
 			if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
-				logger$159.warn("Ignoring an unusable event-provision reaper interval", { intervalMs });
+				logger$160.warn("Ignoring an unusable event-provision reaper interval", { intervalMs });
 				return;
 			}
 			if (intervalMs === this.scheduledIntervalMs) return;
-			logger$159.info("Rescheduling event-provision reaper", {
+			logger$160.info("Rescheduling event-provision reaper", {
 				fromMs: this.scheduledIntervalMs,
 				toMs: intervalMs
 			});
@@ -5219,7 +5219,7 @@ var init_event_provision_reaper = __esmMin((() => {
 			if (this.timer) clearInterval(this.timer);
 			this.scheduledIntervalMs = intervalMs;
 			this.timer = setInterval(() => {
-				runDetached(logger$159, "Event provision reaper tick", () => this.tick());
+				runDetached(logger$160, "Event provision reaper tick", () => this.tick());
 			}, intervalMs);
 			this.timer.unref?.();
 		}
@@ -5261,7 +5261,7 @@ var init_event_provision_reaper = __esmMin((() => {
 		*/
 		verdict(candidate, now, windows) {
 			if (this.opts.isAgentRegistered(candidate.agentId)) {
-				if (this.strandedSince.delete(candidate.agentId)) logger$159.info("Event-scaler provision seen registered again, absence clock cleared", {
+				if (this.strandedSince.delete(candidate.agentId)) logger$160.info("Event-scaler provision seen registered again, absence clock cleared", {
 					agentId: candidate.agentId,
 					scalerName: candidate.scalerName
 				});
@@ -5270,7 +5270,7 @@ var init_event_provision_reaper = __esmMin((() => {
 			const since = this.strandedSince.get(candidate.agentId);
 			if (since === void 0) {
 				this.strandedSince.set(candidate.agentId, now);
-				logger$159.info("Event-scaler provision registered nowhere, starting absence clock", {
+				logger$160.info("Event-scaler provision registered nowhere, starting absence clock", {
 					agentId: candidate.agentId,
 					scalerName: candidate.scalerName,
 					adoptedBy: candidate.adoptedBy
@@ -5287,7 +5287,7 @@ var init_event_provision_reaper = __esmMin((() => {
 			if (!candidate.ownerInstanceId) {
 				if (!this.unknownOwnerLogged.has(candidate.agentId)) {
 					this.unknownOwnerLogged.add(candidate.agentId);
-					logger$159.warn("Sparing an event-scaler provision whose owner is unknown", {
+					logger$160.warn("Sparing an event-scaler provision whose owner is unknown", {
 						agentId: candidate.agentId,
 						scalerName: candidate.scalerName,
 						spawnedAt: candidate.spawnedAt.toISOString()
@@ -5441,7 +5441,7 @@ function replyToPeerForgetRequest(msg, handler, send, logFields = {}) {
 		return;
 	}
 	handler(msg).then(reply, (err) => {
-		logger$158.error("Error answering a peer forget request", {
+		logger$159.error("Error answering a peer forget request", {
 			...logFields,
 			instanceId: msg.instanceId,
 			error: toErrorMessage(err)
@@ -5491,11 +5491,11 @@ async function forgetAcrossCoordinators(registry, selfInstanceId, instanceId, ti
 function disconnectedCoordinatorIds(registry, selfInstanceId) {
 	return registry.getCoordinatorPeers().filter((peer) => !peer.connected && peer.instanceId !== selfInstanceId).map((peer) => peer.instanceId).sort();
 }
-var logger$158, LOCAL_REFUSALS, PEER_FORGET_COORDINATORS_ONLY, PEER_FORGET_UNHANDLED, PeerLivenessWindowKind, PeerForgetWaiters;
+var logger$159, LOCAL_REFUSALS, PEER_FORGET_COORDINATORS_ONLY, PEER_FORGET_UNHANDLED, PeerLivenessWindowKind, PeerForgetWaiters;
 var init_peer_forget = __esmMin((() => {
 	init_peer_request_waiters();
 	init_event_provision_reaper();
-	logger$158 = createLogger({ prefix: "peer-forget" });
+	logger$159 = createLogger({ prefix: "peer-forget" });
 	LOCAL_REFUSALS = /* @__PURE__ */ new Set([
 		PeerForgetOutcome.enum.connected,
 		PeerForgetOutcome.enum.recent,
@@ -5548,7 +5548,7 @@ function replyToScalerOrphansRequest(msg, handler, send, logFields = {}) {
 		return;
 	}
 	handler(msg).then(reply, (err) => {
-		logger$157.error("Error answering a scaler orphan request", {
+		logger$158.error("Error answering a scaler orphan request", {
 			...logFields,
 			action: msg.action,
 			error: toErrorMessage(err)
@@ -5559,10 +5559,10 @@ function replyToScalerOrphansRequest(msg, handler, send, logFields = {}) {
 		});
 	});
 }
-var logger$157, SCALER_ORPHANS_UNHANDLED_ERROR, SCALER_ORPHANS_COORDINATORS_ONLY_ERROR, ScalerOrphansForwardFailure, ScalerOrphansWaiters;
+var logger$158, SCALER_ORPHANS_UNHANDLED_ERROR, SCALER_ORPHANS_COORDINATORS_ONLY_ERROR, ScalerOrphansForwardFailure, ScalerOrphansWaiters;
 var init_scaler_orphans_peer = __esmMin((() => {
 	init_peer_request_waiters();
-	logger$157 = createLogger({ prefix: "scaler-orphans-peer" });
+	logger$158 = createLogger({ prefix: "scaler-orphans-peer" });
 	SCALER_ORPHANS_UNHANDLED_ERROR = "scaler orphan requests are not handled by this peer";
 	SCALER_ORPHANS_COORDINATORS_ONLY_ERROR = "scaler orphan requests are accepted from coordinators only";
 	ScalerOrphansForwardFailure = z.enum(["not-connected", "timeout"]);
@@ -5608,7 +5608,7 @@ function replyToScalerReloadRequest(msg, handler, send, logFields = {}) {
 		...base,
 		...result
 	}), (err) => {
-		logger$156.error("Error answering a scaler reload request", {
+		logger$157.error("Error answering a scaler reload request", {
 			...logFields,
 			error: toErrorMessage(err)
 		});
@@ -5619,10 +5619,10 @@ function replyToScalerReloadRequest(msg, handler, send, logFields = {}) {
 		});
 	});
 }
-var logger$156, SCALER_RELOAD_UNHANDLED_DETAIL, SCALER_RELOAD_COORDINATORS_ONLY_DETAIL, ScalerReloadWaiters;
+var logger$157, SCALER_RELOAD_UNHANDLED_DETAIL, SCALER_RELOAD_COORDINATORS_ONLY_DETAIL, ScalerReloadWaiters;
 var init_scaler_reload_peer = __esmMin((() => {
 	init_peer_request_waiters();
-	logger$156 = createLogger({ prefix: "scaler-reload-peer" });
+	logger$157 = createLogger({ prefix: "scaler-reload-peer" });
 	SCALER_RELOAD_UNHANDLED_DETAIL = "scaler reload requests are not handled by this peer";
 	SCALER_RELOAD_COORDINATORS_ONLY_DETAIL = "scaler reload requests are accepted from coordinators only";
 	ScalerReloadWaiters = class extends PeerRequestWaiters {
@@ -5958,7 +5958,7 @@ var init_join_token = __esmMin((() => {
 			return row ? routingFromRow(row.routing_info, row.role) : null;
 		}
 	};
-})), logger$155, NO_AUTH_METHOD_MESSAGE, NO_AUTH_METHOD_REMEDY, PEER_MUTUAL_AUTH_UNSUPPORTED_MESSAGE, DEFAULT_HANDSHAKE_TIMEOUT_MS, PeerDialOrigin$1, SOFTWARE_VERSION$1, PeerClient$1;
+})), logger$156, NO_AUTH_METHOD_MESSAGE, NO_AUTH_METHOD_REMEDY, PEER_MUTUAL_AUTH_UNSUPPORTED_MESSAGE, DEFAULT_HANDSHAKE_TIMEOUT_MS, PeerDialOrigin$1, SOFTWARE_VERSION$1, PeerClient$1;
 var init_peer_client = __esmMin((() => {
 	init_peer_registry();
 	init_peer_forget();
@@ -5967,7 +5967,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	init_run_detached();
-	logger$155 = createLogger({ prefix: "peer-client" });
+	logger$156 = createLogger({ prefix: "peer-client" });
 	NO_AUTH_METHOD_MESSAGE = "No peer auth method: this instance has no credential file and no join token";
 	NO_AUTH_METHOD_REMEDY = "A coordinator issues its own credential unless an operator revoked it; a worker needs KICI_CLUSTER_JOIN_TOKEN";
 	PEER_MUTUAL_AUTH_UNSUPPORTED_MESSAGE = "Peer does not support mutual authentication; upgrade every orchestrator in the cluster";
@@ -5979,7 +5979,7 @@ var init_peer_client = __esmMin((() => {
 		PeerDialOrigin["Discovered"] = "discovered";
 		return PeerDialOrigin;
 	}({});
-	SOFTWARE_VERSION$1 = "0.18.0";
+	SOFTWARE_VERSION$1 = "0.20.0";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -6083,7 +6083,7 @@ var init_peer_client = __esmMin((() => {
 		}
 		connect() {
 			if (this._state !== "disconnected") {
-				logger$155.warn("connect() called while not disconnected", { state: this._state });
+				logger$156.warn("connect() called while not disconnected", { state: this._state });
 				return;
 			}
 			this.intentionalDisconnect = false;
@@ -6270,7 +6270,7 @@ var init_peer_client = __esmMin((() => {
 					}
 				});
 			} catch (err) {
-				logger$155.error("Failed to create peer WebSocket", { error: toErrorMessage(err) });
+				logger$156.error("Failed to create peer WebSocket", { error: toErrorMessage(err) });
 				this._state = "disconnected";
 				this.scheduleReconnect();
 				return;
@@ -6279,13 +6279,13 @@ var init_peer_client = __esmMin((() => {
 			this.armHandshakeTimer(ws);
 			this.ws.on("open", () => {
 				this._state = "handshaking";
-				logger$155.info("Connected to peer, waiting for ECDH handshake", { url: this.url });
+				logger$156.info("Connected to peer, waiting for ECDH handshake", { url: this.url });
 			});
 			this.ws.on("message", (data) => {
 				this.handleMessage(data);
 			});
 			this.ws.on("close", (code, reason) => {
-				logger$155.info("Peer connection closed", {
+				logger$156.info("Peer connection closed", {
 					code,
 					reason: reason.toString(),
 					targetInstanceId: this._targetInstanceId
@@ -6303,7 +6303,7 @@ var init_peer_client = __esmMin((() => {
 				if (!this.intentionalDisconnect) this.scheduleReconnect();
 			});
 			this.ws.on("error", (err) => {
-				logger$155.error("Peer WebSocket error", { error: err.message });
+				logger$156.error("Peer WebSocket error", { error: err.message });
 				if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close();
 			});
 		}
@@ -6323,19 +6323,19 @@ var init_peer_client = __esmMin((() => {
 			try {
 				decrypted = decryptMessage(raw, this.sessionKey);
 			} catch {
-				logger$155.warn("Failed to decrypt message from peer");
+				logger$156.warn("Failed to decrypt message from peer");
 				return;
 			}
 			let parsed;
 			try {
 				parsed = JSON.parse(decrypted);
 			} catch {
-				logger$155.warn("Malformed JSON from peer");
+				logger$156.warn("Malformed JSON from peer");
 				return;
 			}
 			const msgResult = peerFromPeerMessageSchema.safeParse(parsed);
 			if (!msgResult.success) {
-				logger$155.warn("Invalid message from peer", { errors: msgResult.error.issues });
+				logger$156.warn("Invalid message from peer", { errors: msgResult.error.issues });
 				return;
 			}
 			this.routeMessage(msgResult.data);
@@ -6345,7 +6345,7 @@ var init_peer_client = __esmMin((() => {
 			this.handshakeTimer = setTimeout(() => {
 				this.handshakeTimer = null;
 				if (this.ws !== ws || this._state === "connected") return;
-				logger$155.warn("Peer handshake timed out", {
+				logger$156.warn("Peer handshake timed out", {
 					url: this.url,
 					state: this._state,
 					timeoutMs: this.handshakeTimeoutMs
@@ -6376,7 +6376,7 @@ var init_peer_client = __esmMin((() => {
 		}
 		/** Close a connection whose handshake broke the protocol. */
 		abortHandshake(reason) {
-			logger$155.warn("Closing peer connection during the handshake", {
+			logger$156.warn("Closing peer connection during the handshake", {
 				url: this.url,
 				reason
 			});
@@ -6387,7 +6387,7 @@ var init_peer_client = __esmMin((() => {
 		}
 		/** Close a connection whose server failed mutual authentication. */
 		failMutualAuth(failure, closeCode) {
-			logger$155.error("Peer failed mutual authentication", {
+			logger$156.error("Peer failed mutual authentication", {
 				url: this.url,
 				failure,
 				origin: this.origin
@@ -6417,7 +6417,7 @@ var init_peer_client = __esmMin((() => {
 			}
 			const authSchemes = hello.data.authSchemes ?? [];
 			if (!authSchemes.includes(PeerAuthScheme.enum["mutual-v2"])) {
-				logger$155.error(PEER_MUTUAL_AUTH_UNSUPPORTED_MESSAGE, {
+				logger$156.error(PEER_MUTUAL_AUTH_UNSUPPORTED_MESSAGE, {
 					url: this.url,
 					advertised: authSchemes
 				});
@@ -6435,7 +6435,7 @@ var init_peer_client = __esmMin((() => {
 			try {
 				handshakeKey = deriveSessionKey(ecdh.privateKey, serverPub, nonce);
 			} catch (err) {
-				logger$155.error("ECDH key derivation failed", { error: toErrorMessage(err) });
+				logger$156.error("ECDH key derivation failed", { error: toErrorMessage(err) });
 				this.abortHandshake("Key derivation failed");
 				return;
 			}
@@ -6455,7 +6455,7 @@ var init_peer_client = __esmMin((() => {
 			}));
 			this._state = "authenticating";
 			this.sendAuthRequest().catch((err) => {
-				logger$155.error("Failed to send auth request", { error: toErrorMessage(err) });
+				logger$156.error("Failed to send auth request", { error: toErrorMessage(err) });
 				this.abortHandshake("Auth request failed");
 			});
 		}
@@ -6526,13 +6526,13 @@ var init_peer_client = __esmMin((() => {
 		/** The server proved itself: register the peer and start the connected session. */
 		completeAcceptance(msg) {
 			this.clearHandshakeTimer();
-			if (msg.softwareVersion) logger$155.info("Coordinator software version", {
+			if (msg.softwareVersion) logger$156.info("Coordinator software version", {
 				localVersion: SOFTWARE_VERSION$1,
 				coordinatorVersion: msg.softwareVersion
 			});
 			this._targetInstanceId = msg.instanceId;
 			this.onAuthenticated?.(msg.instanceId);
-			logger$155.info("Peer auth accepted", {
+			logger$156.info("Peer auth accepted", {
 				targetInstanceId: msg.instanceId,
 				agentCount: msg.agents?.length ?? 0,
 				scalerBackends: msg.scalerCapacity?.length ?? 0
@@ -6585,7 +6585,7 @@ var init_peer_client = __esmMin((() => {
 		* deletion would not help.
 		*/
 		handleAuthRejected(reason) {
-			logger$155.error("Peer auth rejected", { reason });
+			logger$156.error("Peer auth rejected", { reason });
 			const wasJoiner = this.isJoiner;
 			const joinComplete = this.joinComplete;
 			const provedCredential = this.lastProvedCredential;
@@ -6601,15 +6601,15 @@ var init_peer_client = __esmMin((() => {
 				finish();
 				return;
 			}
-			runDetached(logger$155, "Peer auth rejection handling", async () => {
+			runDetached(logger$156, "Peer auth rejection handling", async () => {
 				try {
 					const action = await this.authCoordinator.reportRejection(provedCredential, reason);
-					logger$155.info("Coordinator rejection action", {
+					logger$156.info("Coordinator rejection action", {
 						reason,
 						action
 					});
 				} catch (err) {
-					logger$155.warn("Coordinator rejection handling failed", {
+					logger$156.warn("Coordinator rejection handling failed", {
 						error: toErrorMessage(err),
 						reason
 					});
@@ -6654,7 +6654,7 @@ var init_peer_client = __esmMin((() => {
 					tokenRouting = parsed.routingB64;
 					psk = Buffer.from(tokenHashOf(parsed.secretHex), "hex");
 				} catch (err) {
-					logger$155.error("KICI_CLUSTER_JOIN_TOKEN is not a valid join token", { error: toErrorMessage(err) });
+					logger$156.error("KICI_CLUSTER_JOIN_TOKEN is not a valid join token", { error: toErrorMessage(err) });
 					decision.complete(null);
 					this.abortHandshake("Invalid join token");
 					return;
@@ -6669,10 +6669,10 @@ var init_peer_client = __esmMin((() => {
 					targetUrl: this.url,
 					remedy: NO_AUTH_METHOD_REMEDY
 				};
-				if (this.noAuthWarned) logger$155.debug(NO_AUTH_METHOD_MESSAGE, meta);
+				if (this.noAuthWarned) logger$156.debug(NO_AUTH_METHOD_MESSAGE, meta);
 				else {
 					this.noAuthWarned = true;
-					logger$155.warn(NO_AUTH_METHOD_MESSAGE, meta);
+					logger$156.warn(NO_AUTH_METHOD_MESSAGE, meta);
 				}
 				if (this.ws.readyState === WebSocket.OPEN) this.ws.close(1e3, "No auth method");
 				return;
@@ -6691,7 +6691,7 @@ var init_peer_client = __esmMin((() => {
 				clientProof,
 				mode
 			};
-			logger$155.info("Sending mutual-v2 auth request", {
+			logger$156.info("Sending mutual-v2 auth request", {
 				targetUrl: this.url,
 				mode,
 				...mode === PeerAuthMode.enum.token && { reason: "no-credential-file" }
@@ -6750,7 +6750,7 @@ var init_peer_client = __esmMin((() => {
 					break;
 				case "job.reroute":
 					this.onJobReroute(msg).catch((err) => {
-						logger$155.error("Error handling job reroute", { error: toErrorMessage(err) });
+						logger$156.error("Error handling job reroute", { error: toErrorMessage(err) });
 					});
 					break;
 				case "job.reroute.ack": {
@@ -6758,7 +6758,7 @@ var init_peer_client = __esmMin((() => {
 					if (waiter) {
 						clearTimeout(waiter.timer);
 						this.ackWaiters.delete(msg.messageId);
-						if (!msg.accepted) logger$155.info("Reroute ACK rejected by peer", {
+						if (!msg.accepted) logger$156.info("Reroute ACK rejected by peer", {
 							targetInstanceId: this._targetInstanceId,
 							reason: msg.reason
 						});
@@ -6768,7 +6768,7 @@ var init_peer_client = __esmMin((() => {
 				}
 				case "job.progress":
 					if (this._targetInstanceId === null) {
-						logger$155.warn("Dropping job.progress received before peer authentication completed");
+						logger$156.warn("Dropping job.progress received before peer authentication completed");
 						break;
 					}
 					this.onJobProgress(msg, this._targetInstanceId, (out) => this.send(out));
@@ -6795,7 +6795,7 @@ var init_peer_client = __esmMin((() => {
 					if (this.onPeerCacheUploadRequest) this.onPeerCacheUploadRequest(msg).then((response) => {
 						this.send(response);
 					}).catch((err) => {
-						logger$155.error("Error handling cache upload request", { error: toErrorMessage(err) });
+						logger$156.error("Error handling cache upload request", { error: toErrorMessage(err) });
 					});
 					break;
 				case "peer.cache.upload.response": {
@@ -6808,7 +6808,7 @@ var init_peer_client = __esmMin((() => {
 					break;
 				}
 				case "peer.auth.request":
-					logger$155.warn("Unexpected peer.auth.request on outgoing connection");
+					logger$156.warn("Unexpected peer.auth.request on outgoing connection");
 					break;
 				case "raft.vote.response":
 					this.onRaftVoteResponse?.(msg);
@@ -6840,7 +6840,7 @@ var init_peer_client = __esmMin((() => {
 					handler(msg).then((result) => {
 						sendReply(result);
 					}).catch((err) => {
-						logger$155.error("Error executing peer config reload", { error: toErrorMessage(err) });
+						logger$156.error("Error executing peer config reload", { error: toErrorMessage(err) });
 						sendReply({
 							success: false,
 							errors: [toErrorMessage(err)]
@@ -6867,7 +6867,7 @@ var init_peer_client = __esmMin((() => {
 					break;
 				}
 				case "peer.logs.collect.request":
-					runDetached(logger$155, "Peer logs collect request", () => this.onLogsCollectRequest?.(msg, (out) => this.send(out)), {
+					runDetached(logger$156, "Peer logs collect request", () => this.onLogsCollectRequest?.(msg, (out) => this.send(out)), {
 						messageType: msg.type,
 						peerId: this._targetInstanceId
 					});
@@ -6900,7 +6900,7 @@ var init_peer_client = __esmMin((() => {
 			this.cancelReconnect();
 			const delay = this.getReconnectDelay();
 			this.reconnectAttempts++;
-			logger$155.info("Scheduling peer reconnect", {
+			logger$156.info("Scheduling peer reconnect", {
 				attempt: this.reconnectAttempts,
 				delayMs: Math.round(delay)
 			});
@@ -7302,12 +7302,12 @@ function deferred() {
 		resolve
 	};
 }
-var logger$154, DEFAULT_JOIN_WAIT_TIMEOUT_MS, MAX_DECIDE_ITERATIONS, RejectionAction, PeerAuthCoordinator$1;
+var logger$155, DEFAULT_JOIN_WAIT_TIMEOUT_MS, MAX_DECIDE_ITERATIONS, RejectionAction, PeerAuthCoordinator$1;
 var init_peer_auth_coordinator = __esmMin((() => {
 	init_peer_credentials();
 	init_run_detached();
 	init_coordinator_credential();
-	logger$154 = createLogger({ prefix: "peer-auth-coordinator" });
+	logger$155 = createLogger({ prefix: "peer-auth-coordinator" });
 	DEFAULT_JOIN_WAIT_TIMEOUT_MS = 1e4;
 	MAX_DECIDE_ITERATIONS = 3;
 	RejectionAction = /* @__PURE__ */ function(RejectionAction) {
@@ -7353,7 +7353,7 @@ var init_peer_auth_coordinator = __esmMin((() => {
 			try {
 				cred = await readCredentialFile(this.credentialFile);
 			} catch (err) {
-				logger$154.warn("Ignoring unreadable peer credential file", {
+				logger$155.warn("Ignoring unreadable peer credential file", {
 					instanceId: this.instanceId,
 					path: this.credentialFile,
 					error: toErrorMessage(err)
@@ -7420,7 +7420,7 @@ var init_peer_auth_coordinator = __esmMin((() => {
 		}
 		makeComplete(join) {
 			return (issued) => {
-				runDetached(logger$154, "Peer token-join completion", () => this.withLock(async () => {
+				runDetached(logger$155, "Peer token-join completion", () => this.withLock(async () => {
 					if (issued) await writeCredentialFile(this.credentialFile, issued);
 					if (this.inFlightJoin === join) this.inFlightJoin = null;
 					join.resolve(issued);
@@ -7434,7 +7434,7 @@ var init_peer_auth_coordinator = __esmMin((() => {
 			const timeout = new Promise((res) => {
 				timer = setTimeout(() => {
 					if (this.inFlightJoin === join) this.inFlightJoin = null;
-					logger$154.warn("In-flight peer token-join timed out; waiter will retry", { instanceId: this.instanceId });
+					logger$155.warn("In-flight peer token-join timed out; waiter will retry", { instanceId: this.instanceId });
 					res();
 				}, this.joinWaitTimeoutMs);
 			});
@@ -7445,7 +7445,7 @@ var init_peer_auth_coordinator = __esmMin((() => {
 			return this.withLock(async () => {
 				const cred = await this.readValidCredential();
 				if (cred && cred.credential !== provedCredential) {
-					logger$154.info("Credential refreshed by sibling; retrying credential auth", {
+					logger$155.info("Credential refreshed by sibling; retrying credential auth", {
 						instanceId: this.instanceId,
 						reason
 					});
@@ -7454,7 +7454,7 @@ var init_peer_auth_coordinator = __esmMin((() => {
 				if (cred && this.corroborateRejection) {
 					const verdict = await this.corroborateRejection(cred.credential);
 					if (verdict !== "not-held") {
-						logger$154.warn("A peer rejected a credential this cluster holds as valid; keeping the credential file", {
+						logger$155.warn("A peer rejected a credential this cluster holds as valid; keeping the credential file", {
 							instanceId: this.instanceId,
 							reason,
 							verdict
@@ -7464,12 +7464,12 @@ var init_peer_auth_coordinator = __esmMin((() => {
 				}
 				try {
 					await unlink(this.credentialFile);
-					logger$154.warn("Deleted stale credential file after server rejection", {
+					logger$155.warn("Deleted stale credential file after server rejection", {
 						instanceId: this.instanceId,
 						reason
 					});
 				} catch (err) {
-					if (err.code !== "ENOENT") logger$154.warn("Failed to delete stale credential file", {
+					if (err.code !== "ENOENT") logger$155.warn("Failed to delete stale credential file", {
 						instanceId: this.instanceId,
 						path: this.credentialFile
 					});
@@ -7592,7 +7592,7 @@ function createPeerHandler(deps) {
 		const connected = peerRegistry.getConnectedWorkerPeers().length;
 		if (shouldAdmitWorker(role, ceiling, connected)) return true;
 		const reason = `Plan limit: this organization allows ${(ceiling ?? 0) + 1} orchestrator(s), coordinators and workers combined`;
-		logger$153.warn("Worker join refused by plan ceiling", {
+		logger$154.warn("Worker join refused by plan ceiling", {
 			peerInstanceId,
 			connected,
 			ceiling
@@ -7633,7 +7633,7 @@ function createPeerHandler(deps) {
 				break;
 			case "job.reroute":
 				onJobReroute(msg).catch((err) => {
-					logger$153.error("Error handling job reroute from peer", { error: toErrorMessage(err) });
+					logger$154.error("Error handling job reroute from peer", { error: toErrorMessage(err) });
 				});
 				break;
 			case "job.reroute.ack": {
@@ -7670,7 +7670,7 @@ function createPeerHandler(deps) {
 				if (onPeerCacheUploadRequest) onPeerCacheUploadRequest(msg, conn.peerInstanceId).then((response) => {
 					sendEncryptedMessage(conn.ws, conn.sessionKey, response);
 				}).catch((err) => {
-					logger$153.error("Error handling cache upload request from peer", {
+					logger$154.error("Error handling cache upload request from peer", {
 						peerId: conn.peerInstanceId,
 						error: toErrorMessage(err)
 					});
@@ -7691,13 +7691,13 @@ function createPeerHandler(deps) {
 				});
 				break;
 			case "peer.cache.upload.response":
-				logger$153.warn("Unexpected peer.cache.upload.response on incoming connection");
+				logger$154.warn("Unexpected peer.cache.upload.response on incoming connection");
 				break;
 			case "peer.auth.request":
-				logger$153.warn("Unexpected peer.auth.request after authentication");
+				logger$154.warn("Unexpected peer.auth.request after authentication");
 				break;
 			case "peer.auth.response":
-				logger$153.warn("Unexpected peer.auth.response on incoming connection");
+				logger$154.warn("Unexpected peer.auth.response on incoming connection");
 				break;
 			case "raft.vote.response":
 				onRaftVoteResponse?.(msg);
@@ -7729,7 +7729,7 @@ function createPeerHandler(deps) {
 				handler(msg).then((result) => {
 					sendResponse(result);
 				}).catch((err) => {
-					logger$153.error("Error executing peer config reload", {
+					logger$154.error("Error executing peer config reload", {
 						peerId: conn.peerInstanceId,
 						error: toErrorMessage(err)
 					});
@@ -7754,7 +7754,7 @@ function createPeerHandler(deps) {
 					sendEncryptedMessage(conn.ws, conn.sessionKey, response);
 				};
 				if (conn.authenticatedRole !== "coordinator") {
-					logger$153.warn("Refused a scaler orphan request from a peer that is not a coordinator", {
+					logger$154.warn("Refused a scaler orphan request from a peer that is not a coordinator", {
 						peerId: conn.peerInstanceId,
 						role: conn.authenticatedRole,
 						declaredRole: peerRegistry.getPeer(conn.peerInstanceId)?.role ?? "unknown"
@@ -7778,7 +7778,7 @@ function createPeerHandler(deps) {
 					sendEncryptedMessage(conn.ws, conn.sessionKey, response);
 				};
 				if (conn.authenticatedRole !== "coordinator") {
-					logger$153.warn("Refused a scaler reload request from a peer that is not a coordinator", {
+					logger$154.warn("Refused a scaler reload request from a peer that is not a coordinator", {
 						peerId: conn.peerInstanceId,
 						role: conn.authenticatedRole
 					});
@@ -7806,7 +7806,7 @@ function createPeerHandler(deps) {
 					});
 				};
 				if (conn.authenticatedRole !== "coordinator") {
-					logger$153.warn("Refused a peer forget request from a peer that is not a coordinator", {
+					logger$154.warn("Refused a peer forget request from a peer that is not a coordinator", {
 						peerId: conn.peerInstanceId,
 						role: conn.authenticatedRole
 					});
@@ -7831,7 +7831,7 @@ function createPeerHandler(deps) {
 						...resolved
 					});
 				}).catch((err) => {
-					logger$153.error("Error resolving peer cluster-settings request", {
+					logger$154.error("Error resolving peer cluster-settings request", {
 						peerId: conn.peerInstanceId,
 						error: toErrorMessage(err)
 					});
@@ -7839,7 +7839,7 @@ function createPeerHandler(deps) {
 				break;
 			}
 			case "peer.logs.collect.request":
-				runDetached(logger$153, "Peer logs collect request", () => onLogsCollectRequest?.(msg, (out) => {
+				runDetached(logger$154, "Peer logs collect request", () => onLogsCollectRequest?.(msg, (out) => {
 					sendEncryptedMessage(conn.ws, conn.sessionKey, out);
 					return true;
 				}), {
@@ -7856,7 +7856,7 @@ function createPeerHandler(deps) {
 	function handleConnection(ws, remoteIp) {
 		const ip = remoteIp ?? "unknown";
 		if (isRateLimited(ip)) {
-			logger$153.warn("Rate limited peer connection attempt", { ip });
+			logger$154.warn("Rate limited peer connection attempt", { ip });
 			ws.close(WS_CLOSE_UNAUTHORIZED, "Rate limited");
 			return;
 		}
@@ -7870,7 +7870,7 @@ function createPeerHandler(deps) {
 		let ownConn = null;
 		const authTimer = setTimeout(() => {
 			if (!authenticated) {
-				logger$153.warn("Peer auth timeout, closing connection");
+				logger$154.warn("Peer auth timeout, closing connection");
 				ws.close(WS_CLOSE_AUTH_TIMEOUT, "Auth timeout");
 			}
 		}, authTimeoutMs);
@@ -7895,7 +7895,7 @@ function createPeerHandler(deps) {
 			}
 			if (!authenticated) {
 				if (authInFlight) {
-					logger$153.warn("Peer sent a frame while its authentication was in flight", { ip });
+					logger$154.warn("Peer sent a frame while its authentication was in flight", { ip });
 					fail(WS_CLOSE_INVALID_MESSAGE, "Frame during authentication");
 					return;
 				}
@@ -7913,7 +7913,7 @@ function createPeerHandler(deps) {
 					ownConn = registerInboundPeer(ws, authMsg, accepted);
 				}).catch((err) => {
 					authInFlight = false;
-					logger$153.error("Unexpected error during auth handling", { error: toErrorMessage(err) });
+					logger$154.error("Unexpected error during auth handling", { error: toErrorMessage(err) });
 					fail(WS_CLOSE_UNAUTHORIZED, "Auth error");
 				});
 				return;
@@ -7923,19 +7923,19 @@ function createPeerHandler(deps) {
 			try {
 				decrypted = decryptMessage(raw, sessionKey);
 			} catch {
-				logger$153.warn("Failed to decrypt message from authenticated peer");
+				logger$154.warn("Failed to decrypt message from authenticated peer");
 				return;
 			}
 			let parsed;
 			try {
 				parsed = JSON.parse(decrypted);
 			} catch {
-				logger$153.warn("Malformed JSON from peer connection");
+				logger$154.warn("Malformed JSON from peer connection");
 				return;
 			}
 			const msgResult = peerFromPeerMessageSchema.safeParse(parsed);
 			if (!msgResult.success) {
-				logger$153.warn("Invalid message from peer", { errors: msgResult.error.issues });
+				logger$154.warn("Invalid message from peer", { errors: msgResult.error.issues });
 				return;
 			}
 			const conn = connections.get(peerInstanceId);
@@ -7945,7 +7945,7 @@ function createPeerHandler(deps) {
 			closed = true;
 			clearTimeout(authTimer);
 			if (peerInstanceId && ownConn) {
-				logger$153.info("Peer disconnected", { peerInstanceId });
+				logger$154.info("Peer disconnected", { peerInstanceId });
 				if (ownConn.heartbeatTimer) {
 					clearInterval(ownConn.heartbeatTimer);
 					ownConn.heartbeatTimer = null;
@@ -7957,7 +7957,7 @@ function createPeerHandler(deps) {
 			}
 		});
 		ws.on("error", (err) => {
-			logger$153.error("Peer connection error", { error: toErrorMessage(err) });
+			logger$154.error("Peer connection error", { error: toErrorMessage(err) });
 		});
 	}
 	/** The peer's plaintext hello.response: derive K_hs and the transcript hash, or close. */
@@ -7966,12 +7966,12 @@ function createPeerHandler(deps) {
 		try {
 			parsed = JSON.parse(raw);
 		} catch {
-			logger$153.warn("Malformed JSON during ECDH handshake");
+			logger$154.warn("Malformed JSON during ECDH handshake");
 			return null;
 		}
 		const helloResp = peerHelloResponseSchema.safeParse(parsed);
 		if (!helloResp.success) {
-			logger$153.warn("Expected peer.hello.response, got invalid message");
+			logger$154.warn("Expected peer.hello.response, got invalid message");
 			fail(WS_CLOSE_INVALID_MESSAGE, "Expected hello response");
 			return null;
 		}
@@ -7987,7 +7987,7 @@ function createPeerHandler(deps) {
 				})
 			};
 		} catch (err) {
-			logger$153.warn("ECDH key derivation failed", { error: toErrorMessage(err) });
+			logger$154.warn("ECDH key derivation failed", { error: toErrorMessage(err) });
 			fail(WS_CLOSE_INVALID_MESSAGE, "Key derivation failed");
 			return null;
 		}
@@ -8003,7 +8003,7 @@ function createPeerHandler(deps) {
 		try {
 			decrypted = decryptMessage(raw, hs.handshakeKey);
 		} catch (err) {
-			logger$153.warn("Failed to decrypt auth request", { error: toErrorMessage(err) });
+			logger$154.warn("Failed to decrypt auth request", { error: toErrorMessage(err) });
 			recordFailedAuth(ip);
 			fail(WS_CLOSE_UNAUTHORIZED, "Decryption failed");
 			return null;
@@ -8012,13 +8012,13 @@ function createPeerHandler(deps) {
 		try {
 			authParsed = JSON.parse(decrypted);
 		} catch {
-			logger$153.warn("Malformed JSON in decrypted auth request");
+			logger$154.warn("Malformed JSON in decrypted auth request");
 			fail(WS_CLOSE_INVALID_MESSAGE, "Invalid auth format");
 			return null;
 		}
 		if (isLegacyPeerAuthRequest(authParsed)) {
 			const legacyId = authParsed.instanceId;
-			logger$153.warn("Peer used an authentication scheme this release no longer accepts; upgrade every orchestrator in the cluster", {
+			logger$154.warn("Peer used an authentication scheme this release no longer accepts; upgrade every orchestrator in the cluster", {
 				peerInstanceId: typeof legacyId === "string" ? legacyId : null,
 				ip
 			});
@@ -8033,7 +8033,7 @@ function createPeerHandler(deps) {
 		}
 		const authMsg = peerAuthRequestSchema.safeParse(authParsed);
 		if (!authMsg.success) {
-			logger$153.warn("Invalid peer.auth.request format", { errors: authMsg.error.issues });
+			logger$154.warn("Invalid peer.auth.request format", { errors: authMsg.error.issues });
 			fail(WS_CLOSE_INVALID_MESSAGE, "Invalid auth request");
 			return null;
 		}
@@ -8042,7 +8042,7 @@ function createPeerHandler(deps) {
 	/** Register an authenticated inbound peer and start its heartbeats under K_app. */
 	function registerInboundPeer(ws, authMsg, accepted) {
 		const peerInstanceId = authMsg.instanceId;
-		logger$153.info("Peer authenticated", { peerInstanceId });
+		logger$154.info("Peer authenticated", { peerInstanceId });
 		peerRegistry.addPeer({
 			instanceId: peerInstanceId,
 			connectionId: randomUUID(),
@@ -8120,7 +8120,7 @@ function createPeerHandler(deps) {
 	*/
 	async function handleAuth(ws, hs, authMsg, ip) {
 		if (authMsg.protocolVersion < MIN_PROTOCOL_VERSION) {
-			logger$153.warn("Peer protocol version below minimum", {
+			logger$154.warn("Peer protocol version below minimum", {
 				peerInstanceId: authMsg.instanceId,
 				received: authMsg.protocolVersion,
 				minimum: MIN_PROTOCOL_VERSION
@@ -8136,7 +8136,7 @@ function createPeerHandler(deps) {
 			ws.close(WS_CLOSE_PROTOCOL_ERROR, "Unsupported protocol version");
 			return null;
 		}
-		if (authMsg.softwareVersion) logger$153.info("Peer software version", {
+		if (authMsg.softwareVersion) logger$154.info("Peer software version", {
 			peerInstanceId: authMsg.instanceId,
 			localVersion: SOFTWARE_VERSION,
 			remoteVersion: authMsg.softwareVersion
@@ -8161,14 +8161,14 @@ function createPeerHandler(deps) {
 	async function authenticateCredential(ws, hs, authMsg, clientProof, ip) {
 		const stored = await credentialStore.findByInstanceId(authMsg.instanceId);
 		if (!stored) {
-			logger$153.warn("Peer credential not found", {
+			logger$154.warn("Peer credential not found", {
 				peerInstanceId: authMsg.instanceId,
 				authPath: "credential-proof"
 			});
 			return rejectAuth(ws, hs, "Unknown credential", ip, authMsg.instanceId);
 		}
 		if (stored.revokedAt) {
-			logger$153.warn("Peer credential revoked", {
+			logger$154.warn("Peer credential revoked", {
 				peerInstanceId: authMsg.instanceId,
 				authPath: "credential-proof",
 				revokedAt: stored.revokedAt.toISOString()
@@ -8177,7 +8177,7 @@ function createPeerHandler(deps) {
 		}
 		const psk = Buffer.from(stored.credentialHash, "hex");
 		if (!proofMatches$1(expectedClientProof(hs, authMsg, psk, ""), clientProof)) {
-			logger$153.warn("Peer credential proof invalid", {
+			logger$154.warn("Peer credential proof invalid", {
 				peerInstanceId: authMsg.instanceId,
 				authPath: "credential-proof"
 			});
@@ -8213,7 +8213,7 @@ function createPeerHandler(deps) {
 			return proofMatches$1(expectedClientProof(hs, authMsg, Buffer.from(tokenHash, "hex"), routingB64), clientProof);
 		});
 		if (resolved.status !== ResolvedJoinTokenStatus.enum.live) {
-			logger$153.warn("Peer token proof matched no live join token", {
+			logger$154.warn("Peer token proof matched no live join token", {
 				peerInstanceId: authMsg.instanceId,
 				status: resolved.status
 			});
@@ -8222,7 +8222,7 @@ function createPeerHandler(deps) {
 		const grant = await claimTokenGrant(resolved.tokenHash, authMsg.instanceId);
 		if (!grant) return rejectAuth(ws, hs, "Invalid token", ip, authMsg.instanceId);
 		if (!acceptedRoles.includes(grant.role)) {
-			logger$153.warn("Peer role mismatch", {
+			logger$154.warn("Peer role mismatch", {
 				peerInstanceId: authMsg.instanceId,
 				accepted: acceptedRoles,
 				actual: grant.role,
@@ -8238,7 +8238,7 @@ function createPeerHandler(deps) {
 			routingKeys: [grant.routingKey],
 			sourceTokenHash: resolved.tokenHash
 		});
-		logger$153.info(grant.trigger === "token-join" ? "Peer credential issued via token join" : "Peer idempotent token retry accepted", {
+		logger$154.info(grant.trigger === "token-join" ? "Peer credential issued via token join" : "Peer idempotent token retry accepted", {
 			peerInstanceId: authMsg.instanceId,
 			trigger: grant.trigger,
 			tokenFingerprint: tokenFingerprint(resolved.tokenHash),
@@ -8266,7 +8266,7 @@ function createPeerHandler(deps) {
 			};
 		} catch (err) {
 			if (!isTokenAlreadyUsedError(err)) {
-				logger$153.warn("Peer token validation failed", {
+				logger$154.warn("Peer token validation failed", {
 					peerInstanceId,
 					tokenFingerprint: tokenFingerprint(tokenHash),
 					error: toErrorMessage(err)
@@ -8276,7 +8276,7 @@ function createPeerHandler(deps) {
 		}
 		const existing = await credentialStore.findByInstanceId(peerInstanceId);
 		if (!existing || existing.revokedAt || existing.sourceTokenHash !== tokenHash) {
-			logger$153.warn("Peer token was already used by another instance", {
+			logger$154.warn("Peer token was already used by another instance", {
 				peerInstanceId,
 				tokenFingerprint: tokenFingerprint(tokenHash)
 			});
@@ -8440,7 +8440,7 @@ function createPeerHandler(deps) {
 		closeAllInbound
 	};
 }
-var logger$153, SOFTWARE_VERSION, ADVERTISED_PEER_AUTH_SCHEMES, MAX_TOKEN_CANDIDATES, RATE_LIMIT_MAX, RATE_LIMIT_WINDOW_MS;
+var logger$154, SOFTWARE_VERSION, ADVERTISED_PEER_AUTH_SCHEMES, MAX_TOKEN_CANDIDATES, RATE_LIMIT_MAX, RATE_LIMIT_WINDOW_MS;
 var init_peer_handler = __esmMin((() => {
 	init_peer_registry();
 	init_peer_forget();
@@ -8449,8 +8449,8 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	init_run_detached();
-	logger$153 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.18.0";
+	logger$154 = createLogger({ prefix: "peer-handler" });
+	SOFTWARE_VERSION = "0.20.0";
 	ADVERTISED_PEER_AUTH_SCHEMES = [PeerAuthScheme.enum["mutual-v2"]];
 	MAX_TOKEN_CANDIDATES = 8;
 	RATE_LIMIT_MAX = 5;
@@ -8478,9 +8478,9 @@ var init_peer_handler = __esmMin((() => {
 * heartbeat (peer.heartbeat every 30s). Raft heartbeat is purely for leader
 * liveness detection.
 */
-var logger$152, RaftNode;
+var logger$153, RaftNode;
 var init_raft = __esmMin((() => {
-	logger$152 = createLogger({ prefix: "raft" });
+	logger$153 = createLogger({ prefix: "raft" });
 	RaftNode = class {
 		instanceId;
 		stateStore;
@@ -8534,7 +8534,7 @@ var init_raft = __esmMin((() => {
 			this.role = "follower";
 			this.stopped = false;
 			this.startedAt = Date.now();
-			logger$152.info("Raft node started", {
+			logger$153.info("Raft node started", {
 				instanceId: this.instanceId,
 				currentTerm: this.currentTerm,
 				leaderId: this.leaderId
@@ -8562,7 +8562,7 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			});
-			logger$152.info("Raft node stopped", {
+			logger$153.info("Raft node stopped", {
 				instanceId: this.instanceId,
 				wasLeader
 			});
@@ -8588,11 +8588,11 @@ var init_raft = __esmMin((() => {
 		handlePeerLeaving(instanceId) {
 			if (this.stopped) return;
 			if (this.role === "leader") {
-				logger$152.debug("Ignoring peer.leaving (we are leader)", { leavingPeer: instanceId });
+				logger$153.debug("Ignoring peer.leaving (we are leader)", { leavingPeer: instanceId });
 				return;
 			}
 			if (instanceId === this.leaderId) {
-				logger$152.info("Current leader is leaving, starting immediate election", {
+				logger$153.info("Current leader is leaving, starting immediate election", {
 					leavingPeer: instanceId,
 					term: this.currentTerm
 				});
@@ -8600,7 +8600,7 @@ var init_raft = __esmMin((() => {
 				this.consecutiveUnansweredElections = 0;
 				this.clearElectionTimer();
 				this.startElection();
-			} else logger$152.debug("Non-leader peer leaving", { leavingPeer: instanceId });
+			} else logger$153.debug("Non-leader peer leaving", { leavingPeer: instanceId });
 		}
 		/** Restart the election timer with a randomized timeout. */
 		resetElectionTimer() {
@@ -8647,7 +8647,7 @@ var init_raft = __esmMin((() => {
 			this.votedFor = this.instanceId;
 			this.role = "candidate";
 			this.votesReceived = /* @__PURE__ */ new Set([this.instanceId]);
-			logger$152.info("Starting election", {
+			logger$153.info("Starting election", {
 				instanceId: this.instanceId,
 				term: this.currentTerm
 			});
@@ -8656,12 +8656,12 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			}).catch((err) => {
-				logger$152.error("Failed to persist election state", { error: toErrorMessage(err) });
+				logger$153.error("Failed to persist election state", { error: toErrorMessage(err) });
 			});
 			const connectedPeerCount = this.peerRegistry.getConnectedCoordinatorPeerCount();
 			if (connectedPeerCount === 0) {
 				if (this.gracePeriodMs > 0 && Date.now() - this.startedAt < this.gracePeriodMs) {
-					logger$152.info("Dormant mode: deferring self-election (grace period active)", {
+					logger$153.info("Dormant mode: deferring self-election (grace period active)", {
 						instanceId: this.instanceId,
 						elapsedMs: Date.now() - this.startedAt,
 						gracePeriodMs: this.gracePeriodMs
@@ -8669,7 +8669,7 @@ var init_raft = __esmMin((() => {
 					this.resetElectionTimer();
 					return;
 				}
-				logger$152.info("No peers connected, self-electing as leader", {
+				logger$153.info("No peers connected, self-electing as leader", {
 					instanceId: this.instanceId,
 					term: this.currentTerm
 				});
@@ -8677,7 +8677,7 @@ var init_raft = __esmMin((() => {
 				return;
 			}
 			if (this.consecutiveUnansweredElections >= 2) {
-				logger$152.warn("No vote responses after consecutive elections, forcing self-election", {
+				logger$153.warn("No vote responses after consecutive elections, forcing self-election", {
 					instanceId: this.instanceId,
 					term: this.currentTerm,
 					consecutiveUnanswered: this.consecutiveUnansweredElections,
@@ -8715,14 +8715,14 @@ var init_raft = __esmMin((() => {
 					votedFor: this.votedFor,
 					leaderId: this.leaderId
 				}).catch((err) => {
-					logger$152.error("Failed to persist vote", { error: toErrorMessage(err) });
+					logger$153.error("Failed to persist vote", { error: toErrorMessage(err) });
 				});
 				this.resetElectionTimer();
-				logger$152.info("Vote granted", {
+				logger$153.info("Vote granted", {
 					candidateId: msg.candidateId,
 					term: msg.term
 				});
-			} else logger$152.info("Vote denied", {
+			} else logger$153.info("Vote denied", {
 				candidateId: msg.candidateId,
 				term: msg.term,
 				currentTerm: this.currentTerm,
@@ -8745,7 +8745,7 @@ var init_raft = __esmMin((() => {
 			this.consecutiveUnansweredElections = 0;
 			if (msg.voteGranted) {
 				this.votesReceived.add(msg.voterId);
-				logger$152.info("Vote received", {
+				logger$153.info("Vote received", {
 					from: msg.voterId,
 					term: msg.term,
 					totalVotes: this.votesReceived.size
@@ -8766,7 +8766,7 @@ var init_raft = __esmMin((() => {
 			this.leaderId = this.instanceId;
 			this.consecutiveUnansweredElections = 0;
 			this.clearElectionTimer();
-			logger$152.info("Became leader", {
+			logger$153.info("Became leader", {
 				instanceId: this.instanceId,
 				term: this.currentTerm
 			});
@@ -8776,7 +8776,7 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			}).catch((err) => {
-				logger$152.error("Failed to persist leader state", { error: toErrorMessage(err) });
+				logger$153.error("Failed to persist leader state", { error: toErrorMessage(err) });
 			});
 			this.onBecomeLeader();
 		}
@@ -8795,16 +8795,16 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			}).catch((err) => {
-				logger$152.error("Failed to persist step-down state", { error: toErrorMessage(err) });
+				logger$153.error("Failed to persist step-down state", { error: toErrorMessage(err) });
 			});
 			if (wasLeader) {
-				logger$152.info("Lost leadership", {
+				logger$153.info("Lost leadership", {
 					instanceId: this.instanceId,
 					newTerm,
 					newLeaderId
 				});
 				this.onLoseLeadership();
-			} else logger$152.info("Stepped down", {
+			} else logger$153.info("Stepped down", {
 				instanceId: this.instanceId,
 				newTerm,
 				newLeaderId
@@ -8938,9 +8938,9 @@ function shouldDeferReroutedJob(job, peerRegistry, opts) {
 	const flapGraceMs = opts?.flapGraceMs ?? 12e4;
 	return nowMs - peer.lastHeartbeatAt <= flapGraceMs;
 }
-var init_rerouted_job_guard = __esmMin((() => {})), logger$151, ConcurrencyQueueManager;
+var init_rerouted_job_guard = __esmMin((() => {})), logger$152, ConcurrencyQueueManager;
 var init_queue_manager = __esmMin((() => {
-	logger$151 = createLogger({ prefix: "concurrency-queue" });
+	logger$152 = createLogger({ prefix: "concurrency-queue" });
 	ConcurrencyQueueManager = class ConcurrencyQueueManager {
 		db;
 		constructor(db) {
@@ -9009,7 +9009,7 @@ var init_queue_manager = __esmMin((() => {
 				status: "completed",
 				completed_at: /* @__PURE__ */ new Date()
 			}).where("id", "in", leaked.map((r) => r.id)).execute();
-			logger$151.info("Released concurrency slots held by finished runs", {
+			logger$152.info("Released concurrency slots held by finished runs", {
 				groupKey,
 				routingKey,
 				released: leaked.length
@@ -9024,7 +9024,7 @@ var init_queue_manager = __esmMin((() => {
 				routing_key: opts.routingKey,
 				status: "queued"
 			}).execute();
-			logger$151.info("Job enqueued for concurrency group", {
+			logger$152.info("Job enqueued for concurrency group", {
 				groupKey: opts.groupKey,
 				routingKey: opts.routingKey,
 				runId: opts.runId,
@@ -9058,7 +9058,7 @@ var init_queue_manager = __esmMin((() => {
 				status: "cancelled",
 				completed_at: /* @__PURE__ */ new Date()
 			}).where("run_id", "=", runId).where("status", "=", "queued").execute();
-			logger$151.info("Cancelled queued concurrency entries", { runId });
+			logger$152.info("Cancelled queued concurrency entries", { runId });
 		}
 		/** Called when a job finishes (success/failed/cancelled). */
 		async markCompleted(runId, groupKey, routingKey) {
@@ -9085,11 +9085,11 @@ var init_queue_manager = __esmMin((() => {
 }));
 //#endregion
 //#region src/cluster/orphan-recovery.ts
-var logger$150, DEFAULT_STALE_THRESHOLD_MS, DEFAULT_JOB_STUCK_THRESHOLD_MS, OrphanRecovery;
+var logger$151, DEFAULT_STALE_THRESHOLD_MS, DEFAULT_JOB_STUCK_THRESHOLD_MS, OrphanRecovery;
 var init_orphan_recovery = __esmMin((() => {
 	init_rerouted_job_guard();
 	init_queue_manager();
-	logger$150 = createLogger({ prefix: "orphan-recovery" });
+	logger$151 = createLogger({ prefix: "orphan-recovery" });
 	DEFAULT_STALE_THRESHOLD_MS = 3e5;
 	DEFAULT_JOB_STUCK_THRESHOLD_MS = 18e4;
 	OrphanRecovery = class {
@@ -9118,14 +9118,14 @@ var init_orphan_recovery = __esmMin((() => {
 		start() {
 			if (this.scanTimer) return;
 			this.releaseLeakedConcurrencySlots().catch((err) => {
-				logger$150.error("Concurrency slot reconcile failed", { error: toErrorMessage(err) });
+				logger$151.error("Concurrency slot reconcile failed", { error: toErrorMessage(err) });
 			});
 			this.scanTimer = setInterval(() => {
 				this.scanForOrphans().catch((err) => {
-					logger$150.error("Orphan recovery scan failed", { error: toErrorMessage(err) });
+					logger$151.error("Orphan recovery scan failed", { error: toErrorMessage(err) });
 				});
 			}, this.scanIntervalMs);
-			logger$150.info("Orphan recovery started", {
+			logger$151.info("Orphan recovery started", {
 				scanIntervalMs: this.scanIntervalMs,
 				staleThresholdMs: this.staleThresholdMs
 			});
@@ -9135,7 +9135,7 @@ var init_orphan_recovery = __esmMin((() => {
 				clearInterval(this.scanTimer);
 				this.scanTimer = null;
 			}
-			logger$150.info("Orphan recovery stopped");
+			logger$151.info("Orphan recovery stopped");
 		}
 		async scanForOrphans() {
 			if (!this.raft.isLeader()) return;
@@ -9149,7 +9149,7 @@ var init_orphan_recovery = __esmMin((() => {
 				"sha"
 			]).where("status", "=", ExecutionRunStatus.enum.running).where("started_at", "<", staleThreshold).execute();
 			if (staleRuns.length === 0) return;
-			logger$150.info("Found potentially orphaned runs", { count: staleRuns.length });
+			logger$151.info("Found potentially orphaned runs", { count: staleRuns.length });
 			for (const run of staleRuns) await this.recoverRun(run);
 		}
 		/**
@@ -9170,15 +9170,15 @@ var init_orphan_recovery = __esmMin((() => {
 				status: "completed",
 				completed_at: /* @__PURE__ */ new Date()
 			}).where("id", "in", leaked.map((r) => r.id)).execute();
-			logger$150.info("Released concurrency slots held by finished runs", { released: leaked.length });
+			logger$151.info("Released concurrency slots held by finished runs", { released: leaked.length });
 		}
 		async recoverRun(run) {
 			if (this.isCoordinatorStillConnected(run.routing_key)) return;
 			if (await this.hasRecentProgress(run.run_id)) {
-				logger$150.debug("Skipping orphan recovery: run is still making progress", { runId: run.run_id });
+				logger$151.debug("Skipping orphan recovery: run is still making progress", { runId: run.run_id });
 				return;
 			}
-			logger$150.info("Recovering orphan run", {
+			logger$151.info("Recovering orphan run", {
 				runId: run.run_id,
 				routingKey: run.routing_key,
 				workflowName: run.workflow_name
@@ -9196,7 +9196,7 @@ var init_orphan_recovery = __esmMin((() => {
 					completed_at: /* @__PURE__ */ new Date(),
 					failure_reason: "No jobs found for orphaned run"
 				}).where("run_id", "=", run.run_id).where("status", "=", ExecutionRunStatus.enum.running).execute();
-				logger$150.info("Finalized orphan run with no jobs", { runId: run.run_id });
+				logger$151.info("Finalized orphan run with no jobs", { runId: run.run_id });
 				this.executionTracker.emitInfraEvent(run.run_id, "orchestrator.run.orphan_recovered", { metadata: {
 					routingKey: run.routing_key,
 					reason: "No jobs found"
@@ -9208,7 +9208,7 @@ var init_orphan_recovery = __esmMin((() => {
 				if (TERMINAL_JOB_STATES.has(job.status)) continue;
 				const flapGraceMs = await this.clusterSettings.getNumber("reroute_flap_grace_ms", this.rerouteFlapGraceFallbackMs);
 				if (shouldDeferReroutedJob(job, this.peerRegistry, { flapGraceMs })) {
-					logger$150.info("Deferring orphan-fail for rerouted job; worker peer connected or recently seen", {
+					logger$151.info("Deferring orphan-fail for rerouted job; worker peer connected or recently seen", {
 						runId: run.run_id,
 						jobId: job.job_id,
 						peer: job.rerouted_to_peer
@@ -9232,7 +9232,7 @@ var init_orphan_recovery = __esmMin((() => {
 							reason: errorMsg
 						}
 					});
-					logger$150.info("Marked stuck job as failed", {
+					logger$151.info("Marked stuck job as failed", {
 						runId: run.run_id,
 						jobId: job.job_id,
 						jobName: job.job_name
@@ -9374,10 +9374,10 @@ function agentSatisfiesMandatoryLabels(agent, requiredLabels) {
 	const required = new Set(requiredLabels);
 	return mandatory.every((m) => required.has(m));
 }
-var logger$149, DEFAULT_ACK_TIMEOUT_MS, DEFAULT_MAX_HOPS, DEFAULT_REROUTE_SPAWN_WINDOW_MS, DEFAULT_REROUTE_SPAWN_RETRY, NAK_BACKOFF_BASE_MS, NAK_BACKOFF_MAX_MS, RunCoordinator;
+var logger$150, DEFAULT_ACK_TIMEOUT_MS, DEFAULT_MAX_HOPS, DEFAULT_REROUTE_SPAWN_WINDOW_MS, DEFAULT_REROUTE_SPAWN_RETRY, NAK_BACKOFF_BASE_MS, NAK_BACKOFF_MAX_MS, RunCoordinator;
 var init_coordinator = __esmMin((() => {
 	init_worker_eviction();
-	logger$149 = createLogger({ prefix: "coordinator" });
+	logger$150 = createLogger({ prefix: "coordinator" });
 	DEFAULT_ACK_TIMEOUT_MS = 15e3;
 	DEFAULT_MAX_HOPS = 3;
 	DEFAULT_REROUTE_SPAWN_WINDOW_MS = 9e4;
@@ -9442,7 +9442,7 @@ var init_coordinator = __esmMin((() => {
 					this.closePeerViaHandler?.(id, code, reason);
 				}
 			};
-			this.workerEviction = new WorkerEviction(this.peerRegistry, evictionHooks, logger$149);
+			this.workerEviction = new WorkerEviction(this.peerRegistry, evictionHooks, logger$150);
 		}
 		/** In-flight rerouted jobs currently attributed to a peer. */
 		runningJobCountForPeer(instanceId) {
@@ -9538,7 +9538,7 @@ var init_coordinator = __esmMin((() => {
 				}));
 				await Promise.all(reroutePromises);
 			}
-			logger$149.info("Jobs routed", {
+			logger$150.info("Jobs routed", {
 				runId: runContext.runId,
 				local: result.localJobs.length,
 				rerouted: result.reroutedJobs.length,
@@ -9601,7 +9601,7 @@ var init_coordinator = __esmMin((() => {
 						runId: msg.runId
 					});
 				} catch (err) {
-					logger$149.warn("Failed to create check runs for rerouted job", {
+					logger$150.warn("Failed to create check runs for rerouted job", {
 						runId: msg.runId,
 						error: toErrorMessage(err)
 					});
@@ -9619,7 +9619,7 @@ var init_coordinator = __esmMin((() => {
 					jobName: msg.jobName
 				}], msg.routingKey);
 			} catch (err) {
-				logger$149.warn("Failed to register rerouted execution for tracking", {
+				logger$150.warn("Failed to register rerouted execution for tracking", {
 					runId: msg.runId,
 					error: toErrorMessage(err)
 				});
@@ -9642,7 +9642,7 @@ var init_coordinator = __esmMin((() => {
 				tracked.windowTimer = void 0;
 			}
 			if (isSupersededTerminal) {
-				logger$149.warn("Ignoring stray terminal job update from superseded peer", {
+				logger$150.warn("Ignoring stray terminal job update from superseded peer", {
 					runId: msg.runId,
 					jobId: msg.jobId,
 					state: msg.state,
@@ -9665,7 +9665,7 @@ var init_coordinator = __esmMin((() => {
 					state: msg.state
 				});
 			}).catch((err) => {
-				logger$149.error("Failed to track peer job progress", {
+				logger$150.error("Failed to track peer job progress", {
 					error: toErrorMessage(err),
 					runId: msg.runId,
 					jobId: msg.jobId,
@@ -9683,7 +9683,7 @@ var init_coordinator = __esmMin((() => {
 					if (drainedPeerId) this.fireIdleIfDrained(drainedPeerId);
 				}
 			}
-			logger$149.debug("Peer job progress", {
+			logger$150.debug("Peer job progress", {
 				runId: msg.runId,
 				jobId: msg.jobId,
 				kind: msg.kind,
@@ -9740,7 +9740,7 @@ var init_coordinator = __esmMin((() => {
 		onRelayedSpawnFailure(msg, tracked) {
 			const { runId, jobId } = msg;
 			if (msg.final === void 0) {
-				logger$149.info("Worker relayed scaler.failed without a retry verdict — waiting out the spawn window", {
+				logger$150.info("Worker relayed scaler.failed without a retry verdict — waiting out the spawn window", {
 					runId,
 					jobId,
 					detail: msg.detail
@@ -9750,7 +9750,7 @@ var init_coordinator = __esmMin((() => {
 			if (!msg.final) {
 				tracked.spawnFailures += 1;
 				if (tracked.spawnFailures < tracked.spawnRetry.maxAttempts) {
-					logger$149.info("Worker retrying spawn for a rerouted job — spawn window re-armed", {
+					logger$150.info("Worker retrying spawn for a rerouted job — spawn window re-armed", {
 						runId,
 						jobId,
 						attempt: tracked.spawnFailures,
@@ -9758,7 +9758,7 @@ var init_coordinator = __esmMin((() => {
 						detail: msg.detail
 					});
 					this.rearmAfterSpawnRetry(runId, jobId, tracked).catch((err) => {
-						logger$149.error("Reroute spawn-window re-arm failed", {
+						logger$150.error("Reroute spawn-window re-arm failed", {
 							runId,
 							jobId,
 							error: toErrorMessage(err)
@@ -9767,13 +9767,13 @@ var init_coordinator = __esmMin((() => {
 					return;
 				}
 			}
-			logger$149.warn("Worker exhausted spawn retries for a rerouted job — re-dispatching", {
+			logger$150.warn("Worker exhausted spawn retries for a rerouted job — re-dispatching", {
 				runId,
 				jobId,
 				detail: msg.detail
 			});
 			this.handleRerouteSpawnTimeout(runId, jobId).catch((err) => {
-				logger$149.error("Reroute exhausted-retries handler failed", {
+				logger$150.error("Reroute exhausted-retries handler failed", {
 					runId,
 					jobId,
 					error: toErrorMessage(err)
@@ -9794,7 +9794,7 @@ var init_coordinator = __esmMin((() => {
 		*/
 		onPeerJobComplete(runId, jobId, status, timestamp, data) {
 			if (this.executionTracker) this.executionTracker.onJobStatus(runId, jobId, status, timestamp, void 0, data).catch((err) => {
-				logger$149.error("Failed to track peer job completion", {
+				logger$150.error("Failed to track peer job completion", {
 					error: toErrorMessage(err),
 					runId,
 					jobId
@@ -9835,13 +9835,13 @@ var init_coordinator = __esmMin((() => {
 					jobId,
 					reason
 				};
-				if (!this.sendToPeer(peerId, cancelMsg)) logger$149.warn("Failed to send cancel to peer", {
+				if (!this.sendToPeer(peerId, cancelMsg)) logger$150.warn("Failed to send cancel to peer", {
 					peerId,
 					runId,
 					jobId
 				});
 			}
-			logger$149.info("Cancel propagated to peers", {
+			logger$150.info("Cancel propagated to peers", {
 				runId,
 				reason,
 				peerCount: peerJobs.size
@@ -9855,7 +9855,7 @@ var init_coordinator = __esmMin((() => {
 			if (this.staleEvictionTimer) clearInterval(this.staleEvictionTimer);
 			this.staleEvictionTimer = setInterval(() => {
 				const evicted = this.peerRegistry.evictStalePeers(staleTimeoutMs);
-				if (evicted.length > 0) logger$149.warn("Evicted stale peers", {
+				if (evicted.length > 0) logger$150.warn("Evicted stale peers", {
 					evicted,
 					count: evicted.length
 				});
@@ -9899,7 +9899,7 @@ var init_coordinator = __esmMin((() => {
 				if (triedConnections.includes(peer.instanceId)) continue;
 				const nakEntry = this.nakTracker.get(peer.instanceId);
 				if (nakEntry && nakEntry.backoffUntil > now) {
-					logger$149.debug("Skipping peer in NAK backoff", {
+					logger$150.debug("Skipping peer in NAK backoff", {
 						peerId: peer.instanceId,
 						jobName: job.jobName,
 						backoffRemainingMs: nakEntry.backoffUntil - now
@@ -9908,7 +9908,7 @@ var init_coordinator = __esmMin((() => {
 				}
 				const transport = this.rerouteTransport(peer.instanceId);
 				if (transport === null) {
-					logger$149.warn("No link to peer (found in registry but no connection)", {
+					logger$150.warn("No link to peer (found in registry but no connection)", {
 						peerId: peer.instanceId,
 						jobName: job.jobName
 					});
@@ -9926,7 +9926,7 @@ var init_coordinator = __esmMin((() => {
 						triedConnections,
 						spawnRetry
 					});
-					logger$149.info("Job rerouted to peer", {
+					logger$150.info("Job rerouted to peer", {
 						runId: runContext.runId,
 						jobName: job.jobName,
 						jobId,
@@ -9944,7 +9944,7 @@ var init_coordinator = __esmMin((() => {
 					count: nakCount,
 					backoffUntil: Date.now() + backoffMs
 				});
-				logger$149.warn("Peer NAKed job", {
+				logger$150.warn("Peer NAKed job", {
 					peerId: peer.instanceId,
 					jobName: job.jobName,
 					nakCount,
@@ -9961,7 +9961,7 @@ var init_coordinator = __esmMin((() => {
 		noCapacityResult(job, labelSets) {
 			const peersWithLabels = this.peerRegistry.findPeersWithLabels(labelSets);
 			const allPeers = this.peerRegistry.getConnectedPeers();
-			logger$149.debug("Reroute failed — peer registry state", {
+			logger$150.debug("Reroute failed — peer registry state", {
 				jobName: job.jobName,
 				requiredLabels: labelSets,
 				connectedPeers: allPeers.map((p) => ({
@@ -10084,7 +10084,7 @@ var init_coordinator = __esmMin((() => {
 		armRerouteWindow(runId, jobId, windowMs) {
 			return setTimeout(() => {
 				this.handleRerouteSpawnTimeout(runId, jobId).catch((err) => {
-					logger$149.error("Reroute spawn-window handler failed", {
+					logger$150.error("Reroute spawn-window handler failed", {
 						runId,
 						jobId,
 						error: toErrorMessage(err)
@@ -10106,7 +10106,7 @@ var init_coordinator = __esmMin((() => {
 			try {
 				return await this.executionTracker.hasJobStarted(runId, jobId);
 			} catch (err) {
-				logger$149.warn("Could not read rerouted job state; treating the spawn window as elapsed", {
+				logger$150.warn("Could not read rerouted job state; treating the spawn window as elapsed", {
 					runId,
 					jobId,
 					peerId: tracked.peerId,
@@ -10133,7 +10133,7 @@ var init_coordinator = __esmMin((() => {
 			try {
 				terminal = await this.executionTracker?.isJobTerminal(runId, jobId) ?? false;
 			} catch (err) {
-				logger$149.warn("Could not read rerouted job state; keeping the tracking entry", {
+				logger$150.warn("Could not read rerouted job state; keeping the tracking entry", {
 					runId,
 					jobId,
 					peerId: tracked.peerId,
@@ -10143,7 +10143,7 @@ var init_coordinator = __esmMin((() => {
 			if (terminal) {
 				runJobs.delete(jobId);
 				if (runJobs.size === 0) this.reroutedJobs.delete(runId);
-				logger$149.info("Rerouted job reached a terminal state on its peer — tracking released", {
+				logger$150.info("Rerouted job reached a terminal state on its peer — tracking released", {
 					runId,
 					jobId,
 					jobName: tracked.jobName,
@@ -10153,7 +10153,7 @@ var init_coordinator = __esmMin((() => {
 				return;
 			}
 			tracked.windowTimer = this.armRerouteWindow(runId, jobId, await this.getRerouteSpawnWindowMs(tracked.job));
-			logger$149.info("Rerouted job is running on its peer — spawn-window backstop disarmed", {
+			logger$150.info("Rerouted job is running on its peer — spawn-window backstop disarmed", {
 				runId,
 				jobId,
 				jobName: tracked.jobName,
@@ -10181,7 +10181,7 @@ var init_coordinator = __esmMin((() => {
 			if (tracked.windowTimer) clearTimeout(tracked.windowTimer);
 			runJobs.delete(jobId);
 			if (runJobs.size === 0) this.reroutedJobs.delete(runId);
-			logger$149.warn("Rerouted job produced no progress — re-dispatching", {
+			logger$150.warn("Rerouted job produced no progress — re-dispatching", {
 				runId,
 				jobId,
 				jobName: tracked.jobName,
@@ -10195,7 +10195,7 @@ var init_coordinator = __esmMin((() => {
 		}
 		/** Best-effort cancel a single job on a peer (double-execution guard). */
 		cancelPeerJob(peerId, runId, jobId, reason) {
-			if (!this.cancelJobOnPeer(peerId, runId, jobId, reason)) logger$149.warn("Failed to send re-dispatch cancel to peer", {
+			if (!this.cancelJobOnPeer(peerId, runId, jobId, reason)) logger$150.warn("Failed to send re-dispatch cancel to peer", {
 				peerId,
 				runId,
 				jobId
@@ -10274,7 +10274,7 @@ var init_coordinator = __esmMin((() => {
 				if (result.status === "queued-no-backend") await this.dispatcher.cancelQueuedJob(result.jobId, "reroute re-dispatch unroutable");
 				return false;
 			}
-			logger$149.info("Rerouted job re-dispatched locally", {
+			logger$150.info("Rerouted job re-dispatched locally", {
 				runId: runContext.runId,
 				jobId,
 				jobName: job.jobName
@@ -10283,13 +10283,13 @@ var init_coordinator = __esmMin((() => {
 		}
 		/** Mark a job failed when no backend (peer or local) can run it after re-dispatch. */
 		async failUnroutableJob(runId, jobId, jobName) {
-			logger$149.error("Rerouted job unroutable after spawn failure — failing it", {
+			logger$150.error("Rerouted job unroutable after spawn failure — failing it", {
 				runId,
 				jobId,
 				jobName
 			});
 			if (this.executionTracker) await this.executionTracker.onJobStatus(runId, jobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, { reason: "reroute re-dispatch found no available backend after spawn failure" }).catch((err) => {
-				logger$149.error("Failed to record unroutable-job failure", {
+				logger$150.error("Failed to record unroutable-job failure", {
 					runId,
 					jobId,
 					error: toErrorMessage(err)
@@ -11175,10 +11175,10 @@ function satisfiesMandatoryLabels(agent, requiredLabels) {
 	for (const label of agent.mandatoryLabels) if (!requiredSet.has(label)) return false;
 	return true;
 }
-var BUSY_HOLD_MAX_MS, logger$148, AgentRegistry;
+var BUSY_HOLD_MAX_MS, logger$149, AgentRegistry;
 var init_registry = __esmMin((() => {
 	BUSY_HOLD_MAX_MS = 3e4;
-	logger$148 = createLogger({ prefix: "agent-registry" });
+	logger$149 = createLogger({ prefix: "agent-registry" });
 	AgentRegistry = class {
 		agents = /* @__PURE__ */ new Map();
 		/** label -> agentIds, keyed on the canonical label. */
@@ -11340,7 +11340,7 @@ var init_registry = __esmMin((() => {
 					arch,
 					instanceId,
 					properties: metadata?.properties
-				}).catch((err) => logger$148.warn("host_roster upsert failed (best-effort)", {
+				}).catch((err) => logger$149.warn("host_roster upsert failed (best-effort)", {
 					agentId,
 					error: toErrorMessage(err)
 				}));
@@ -11396,7 +11396,7 @@ var init_registry = __esmMin((() => {
 					entry.ws.close(WS_CLOSE_AGENT_AUTH_FAILED, "Token revoked");
 				} catch {}
 				this.disconnectTriage?.(agentId).catch((err) => {
-					logger$148.error("Job triage failed for an agent dropped by token revocation", {
+					logger$149.error("Job triage failed for an agent dropped by token revocation", {
 						agentId,
 						error: toErrorMessage(err)
 					});
@@ -11589,8 +11589,11 @@ var init_registry = __esmMin((() => {
 			return this.agents.has(agentId);
 		}
 		/**
-		* Condemn an agent before a warm-pool destroy: it stays registered and finishes its
-		* current work, but takes no new dispatches.
+		* Condemn an agent: it stays registered and keeps finishing its current work,
+		* but takes no new dispatches.
+		*
+		* Called before a warm-pool destroy is issued. An agent that reports its own
+		* drain goes through {@link markDrainReported} instead.
 		*
 		* @returns the agent's `activeJobs`, so the caller can see a job claimed between its
 		*   idle check and this mark and back out; `undefined` when not registered
@@ -11651,10 +11654,23 @@ var init_registry = __esmMin((() => {
 			const entry = this.agents.get(agentId);
 			if (entry?.busyHeldUntil !== void 0 && now >= entry.busyHeldUntil) delete entry.busyHeldUntil;
 		}
-		/** Undo {@link markDraining} — a destroy that was rejected leaves the agent alive. */
+		/**
+		* The agent reported on `agent.status` that it takes no new job: a drain, or a
+		* single-job agent that has accepted its job. Terminal for this connection.
+		*/
+		markDrainReported(agentId) {
+			const entry = this.agents.get(agentId);
+			if (!entry) return;
+			entry.draining = true;
+			entry.drainReported = true;
+		}
+		/**
+		* Undo {@link markDraining} — a destroy that was rejected leaves the agent alive.
+		* An agent that reported its own drain stays draining.
+		*/
 		clearDraining(agentId) {
 			const entry = this.agents.get(agentId);
-			if (entry) entry.draining = false;
+			if (entry) entry.draining = entry.drainReported === true;
 		}
 		get(agentId) {
 			return this.agents.get(agentId);
@@ -12252,9 +12268,9 @@ var init_leader_gated_scheduler = __esmMin((() => {
 * Driven by the leader-only host-roster reaper's tick (one timer, one leader), so it owns no
 * timer — just a testable `scan()`.
 */
-var logger$147, RebootDeadlineSweep;
+var logger$148, RebootDeadlineSweep;
 var init_reboot_deadline_sweep = __esmMin((() => {
-	logger$147 = createLogger({ prefix: "reboot-deadline-sweep" });
+	logger$148 = createLogger({ prefix: "reboot-deadline-sweep" });
 	RebootDeadlineSweep = class {
 		rosterStore;
 		constructor(deps) {
@@ -12265,22 +12281,22 @@ var init_reboot_deadline_sweep = __esmMin((() => {
 				const expired = await this.rosterStore.listExpiredRebootPending(Date.now());
 				for (const agentId of expired) {
 					await this.rosterStore.clearRebootPending(agentId);
-					logger$147.warn("Host did not return after reboot within deadline; cleared reboot-pending", { agentId });
+					logger$148.warn("Host did not return after reboot within deadline; cleared reboot-pending", { agentId });
 				}
 			} catch (err) {
-				logger$147.error("Reboot deadline sweep error", { error: toErrorMessage(err) });
+				logger$148.error("Reboot deadline sweep error", { error: toErrorMessage(err) });
 			}
 		}
 	};
 }));
 //#endregion
 //#region src/agent/host-roster-reaper.ts
-var logger$146, HostRosterReaper;
+var logger$147, HostRosterReaper;
 var init_host_roster_reaper = __esmMin((() => {
 	init_leader_gated_scheduler();
 	init_reboot_deadline_sweep();
 	init_run_detached();
-	logger$146 = createLogger({ prefix: "host-roster-reaper" });
+	logger$147 = createLogger({ prefix: "host-roster-reaper" });
 	HostRosterReaper = class {
 		store;
 		ttlMs;
@@ -12299,12 +12315,12 @@ var init_host_roster_reaper = __esmMin((() => {
 			this.scheduler = new LeaderGatedScheduler({
 				name: "host roster reaper",
 				intervalMs: this.scanIntervalMs,
-				logger: logger$146,
+				logger: logger$147,
 				tick: () => this.tick()
 			});
 		}
 		onBecomeLeader() {
-			runDetached(logger$146, "Host roster reaper start", () => this.scheduler.onBecomeLeader());
+			runDetached(logger$147, "Host roster reaper start", () => this.scheduler.onBecomeLeader());
 		}
 		onLoseLeadership() {
 			this.scheduler.onLoseLeadership();
@@ -12316,10 +12332,10 @@ var init_host_roster_reaper = __esmMin((() => {
 		async tick() {
 			if (!this.scheduler.isLeader) return;
 			const deleted = await this.store.reapEphemeralPastTtl(this.ttlMs);
-			if (deleted > 0) logger$146.info("Reaped expired ephemeral hosts", { deleted });
+			if (deleted > 0) logger$147.info("Reaped expired ephemeral hosts", { deleted });
 			const unreachable = await this.store.countStaticUnreachable(this.graceMs);
 			this.setUnreachableGauge(unreachable);
-			if (unreachable > 0) logger$146.warn("Declared hosts unreachable", { count: unreachable });
+			if (unreachable > 0) logger$147.warn("Declared hosts unreachable", { count: unreachable });
 			await this.rebootSweep.scan();
 		}
 	};
@@ -12346,16 +12362,16 @@ async function pruneExpiredLogs(storage, ttlDays, now = /* @__PURE__ */ new Date
 	try {
 		return await storage.deleteMany(expired);
 	} catch (err) {
-		logger$145.error("Failed to bulk-delete expired log objects", {
+		logger$146.error("Failed to bulk-delete expired log objects", {
 			count: expired.length,
 			error: toErrorMessage(err)
 		});
 		return 0;
 	}
 }
-var logger$145, LOG_ROOT_PREFIX;
+var logger$146, LOG_ROOT_PREFIX;
 var init_log_retention = __esmMin((() => {
-	logger$145 = createLogger({ prefix: "log-retention" });
+	logger$146 = createLogger({ prefix: "log-retention" });
 	LOG_ROOT_PREFIX = "executions/";
 }));
 //#endregion
@@ -12752,14 +12768,14 @@ function buildJobFailureDescription(data) {
 	if (data.error) return `Job error: ${data.error}`;
 	return "Job failed";
 }
-var logger$144, PROGRESS_DEBOUNCE_MS, CheckRunReporter;
+var logger$145, PROGRESS_DEBOUNCE_MS, CheckRunReporter;
 var init_check_run_reporter = __esmMin((() => {
 	init_auth();
 	init_prometheus();
 	init_reduced_privilege_note();
 	init_check_run_summary();
 	init_run_detached();
-	logger$144 = createLogger({ prefix: "check-run-reporter" });
+	logger$145 = createLogger({ prefix: "check-run-reporter" });
 	PROGRESS_DEBOUNCE_MS = 5e3;
 	CheckRunReporter = class {
 		deps;
@@ -12847,7 +12863,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		setPending(opts) {
 			this.doSetPending(opts).catch((err) => {
-				logger$144.error("Failed to set pending check run", {
+				logger$145.error("Failed to set pending check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -12867,7 +12883,7 @@ var init_check_run_reporter = __esmMin((() => {
 		/** Called when a job reaches a terminal state. Fire-and-forget. */
 		updateJobStatus(opts) {
 			this.doUpdateJobStatus(opts).catch((err) => {
-				logger$144.error("Failed to update job check run", {
+				logger$145.error("Failed to update job check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -12884,7 +12900,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		updateWorkflowStatus(opts) {
 			this.doUpdateWorkflowStatus(opts).catch((err) => {
-				logger$144.error("Failed to update workflow check run", {
+				logger$145.error("Failed to update workflow check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -12915,12 +12931,12 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		async completeUndispatchedCheckRuns(opts) {
 			if (opts.provider !== "github") {
-				logger$144.debug("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$145.debug("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$144.debug("GitHub config or installationId missing, skipping undispatched completion", {
+				logger$145.debug("GitHub config or installationId missing, skipping undispatched completion", {
 					hasConfig: !!githubConfig,
 					hasInstallationId: !!opts.installationId
 				});
@@ -12943,7 +12959,7 @@ var init_check_run_reporter = __esmMin((() => {
 				const key = this.checkRunKey(opts.owner, opts.repo, opts.sha, target.name);
 				const checkRunId = await this.resolveCheckRunId(key);
 				if (!checkRunId) {
-					logger$144.debug("Check run ID not found for undispatched completion, skipping", { key });
+					logger$145.debug("Check run ID not found for undispatched completion, skipping", { key });
 					continue;
 				}
 				if (this.terminalSent.has(key)) continue;
@@ -12963,7 +12979,7 @@ var init_check_run_reporter = __esmMin((() => {
 				}, key, opts.runId);
 				completed++;
 			}
-			if (completed > 0) logger$144.info("Completed check runs for a workflow that never dispatched", {
+			if (completed > 0) logger$145.info("Completed check runs for a workflow that never dispatched", {
 				owner: opts.owner,
 				repo: opts.repo,
 				sha: opts.sha,
@@ -12983,7 +12999,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		cleanupStaleCheckRuns(opts) {
 			this.doCleanupStaleCheckRuns(opts).catch((err) => {
-				logger$144.error("Failed to clean up stale check runs", {
+				logger$145.error("Failed to clean up stale check runs", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -13000,7 +13016,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		updateStepProgress(opts) {
 			this.doUpdateStepProgress(opts).catch((err) => {
-				logger$144.error("Failed to update step progress", {
+				logger$145.error("Failed to update step progress", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					workflowName: opts.workflowName,
@@ -13018,10 +13034,10 @@ var init_check_run_reporter = __esmMin((() => {
 		setBuildPending(opts) {
 			const buildCheckName = `kici/${this.workflowLabel(opts)}/setup`;
 			const key = this.checkRunKey(opts.owner, opts.repo, opts.sha, buildCheckName);
-			runDetached(logger$144, "Build creation marker write", () => this.persistBuildCreationPending(key, opts.runId), { runId: opts.runId });
+			runDetached(logger$145, "Build creation marker write", () => this.persistBuildCreationPending(key, opts.runId), { runId: opts.runId });
 			this.trackRunKey(opts.runId, key);
 			const creation = this.doSetBuildPending(opts).catch((err) => {
-				logger$144.error("Failed to set build pending check run", {
+				logger$145.error("Failed to set build pending check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -13031,12 +13047,12 @@ var init_check_run_reporter = __esmMin((() => {
 				});
 			});
 			this.pendingBuildCreations.set(key, creation);
-			runDetached(logger$144, "Build creation tracking cleanup", () => creation.finally(() => this.pendingBuildCreations.delete(key)), { runId: opts.runId });
+			runDetached(logger$145, "Build creation tracking cleanup", () => creation.finally(() => this.pendingBuildCreations.delete(key)), { runId: opts.runId });
 		}
 		/** Called when the build job finishes (success, failure, or cancellation). Fire-and-forget. */
 		setBuildComplete(opts) {
 			this.doSetBuildComplete(opts).catch((err) => {
-				logger$144.error("Failed to set build complete check run", {
+				logger$145.error("Failed to set build complete check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -13082,7 +13098,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		async recoverState() {
 			if (!this.deps.trackingStore) return;
-			logger$144.info("CheckRunReporter recovered (DB-backed state lookups enabled)");
+			logger$145.info("CheckRunReporter recovered (DB-backed state lookups enabled)");
 		}
 		trackRunKey(runId, key) {
 			if (!runId) return;
@@ -13117,7 +13133,7 @@ var init_check_run_reporter = __esmMin((() => {
 				await this.deps.trackingStore.setCheckRunId(this.parseKey(key), checkRunId, runId);
 				if (runId) await this.deps.trackingStore.markBuildCreationComplete(this.parseKey(key));
 			} catch (err) {
-				logger$144.warn("Failed to persist check_run_tracking row; cache-only fallback", {
+				logger$145.warn("Failed to persist check_run_tracking row; cache-only fallback", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -13142,7 +13158,7 @@ var init_check_run_reporter = __esmMin((() => {
 				if (state?.checkRunId !== void 0) this.checkRunIds.set(key, state.checkRunId);
 				return state?.checkRunId;
 			} catch (err) {
-				logger$144.warn("Failed to read check_run_tracking row; treating as miss", {
+				logger$145.warn("Failed to read check_run_tracking row; treating as miss", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -13155,7 +13171,7 @@ var init_check_run_reporter = __esmMin((() => {
 			try {
 				await this.deps.trackingStore.setStepProgress(this.parseKey(key), steps, runId);
 			} catch (err) {
-				logger$144.warn("Failed to persist step-progress; cache-only fallback", {
+				logger$145.warn("Failed to persist step-progress; cache-only fallback", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -13168,7 +13184,7 @@ var init_check_run_reporter = __esmMin((() => {
 			try {
 				await this.deps.trackingStore.markInProgressSent(this.parseKey(key), runId);
 			} catch (err) {
-				logger$144.warn("Failed to persist in-progress-sent marker; cache-only fallback", {
+				logger$145.warn("Failed to persist in-progress-sent marker; cache-only fallback", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -13180,7 +13196,7 @@ var init_check_run_reporter = __esmMin((() => {
 			try {
 				await this.deps.trackingStore.markBuildCreationPending(this.parseKey(key), runId);
 			} catch (err) {
-				logger$144.warn("Failed to persist build-creation-pending marker", {
+				logger$145.warn("Failed to persist build-creation-pending marker", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -13246,12 +13262,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doSetPending(opts) {
 			if (opts.provider !== "github") {
-				logger$144.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$145.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$144.debug("GitHub config or installationId missing, skipping check run", {
+				logger$145.debug("GitHub config or installationId missing, skipping check run", {
 					hasConfig: !!githubConfig,
 					hasInstallationId: !!opts.installationId
 				});
@@ -13302,12 +13318,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doUpdateJobStatus(opts) {
 			if (opts.provider !== "github") {
-				logger$144.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$145.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$144.debug("GitHub config or installationId missing, skipping check run update");
+				logger$145.debug("GitHub config or installationId missing, skipping check run update");
 				return;
 			}
 			const label = this.workflowLabel(opts);
@@ -13315,7 +13331,7 @@ var init_check_run_reporter = __esmMin((() => {
 			const key = this.checkRunKey(opts.owner, opts.repo, opts.sha, checkName);
 			const checkRunId = await this.resolveCheckRunId(key);
 			if (!checkRunId) {
-				logger$144.warn("Check run ID not found for job update, skipping", { key });
+				logger$145.warn("Check run ID not found for job update, skipping", { key });
 				return;
 			}
 			const pendingTimer = this.progressTimers.get(key);
@@ -13394,19 +13410,19 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doUpdateWorkflowStatus(opts) {
 			if (opts.provider !== "github") {
-				logger$144.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$145.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$144.debug("GitHub config or installationId missing, skipping check run update");
+				logger$145.debug("GitHub config or installationId missing, skipping check run update");
 				return;
 			}
 			const label = this.workflowLabel(opts);
 			const key = this.checkRunKey(opts.owner, opts.repo, opts.sha, `kici/${label}`);
 			const checkRunId = await this.resolveCheckRunId(key);
 			if (!checkRunId) {
-				logger$144.warn("Check run ID not found for workflow update, skipping", { key });
+				logger$145.warn("Check run ID not found for workflow update, skipping", { key });
 				return;
 			}
 			const octokit = createInstallationOctokit(githubConfig, opts.installationId);
@@ -13431,12 +13447,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doCleanupStaleCheckRuns(opts) {
 			if (opts.provider !== "github") {
-				logger$144.debug("Stale check run cleanup not supported for provider, skipping", { provider: opts.provider });
+				logger$145.debug("Stale check run cleanup not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig) {
-				logger$144.debug("GitHub config not available for stale cleanup, skipping", { routingKey: opts.routingKey });
+				logger$145.debug("GitHub config not available for stale cleanup, skipping", { routingKey: opts.routingKey });
 				return;
 			}
 			const appOctokit = new Octokit({
@@ -13454,7 +13470,7 @@ var init_check_run_reporter = __esmMin((() => {
 				});
 				installationId = data.id;
 			} catch (err) {
-				logger$144.warn("Could not find installation for repo, skipping stale cleanup", {
+				logger$145.warn("Could not find installation for repo, skipping stale cleanup", {
 					owner: opts.owner,
 					repo: opts.repo,
 					error: toErrorMessage(err)
@@ -13490,14 +13506,14 @@ var init_check_run_reporter = __esmMin((() => {
 					});
 					cleanedCount++;
 				} catch (updateErr) {
-					logger$144.warn("Failed to update stale check run", {
+					logger$145.warn("Failed to update stale check run", {
 						checkRunId: checkRun.id,
 						checkName: checkRun.name,
 						error: toErrorMessage(updateErr)
 					});
 				}
 				if (cleanedCount > 0) {
-					logger$144.info("Cleaned up stale check runs", {
+					logger$145.info("Cleaned up stale check runs", {
 						owner: opts.owner,
 						repo: opts.repo,
 						sha: opts.sha,
@@ -13507,7 +13523,7 @@ var init_check_run_reporter = __esmMin((() => {
 					githubCheckRunTotal.add(cleanedCount, { operation: "stale_cleanup" });
 				}
 			} catch (err) {
-				logger$144.error("Failed to list check runs for stale cleanup", {
+				logger$145.error("Failed to list check runs for stale cleanup", {
 					owner: opts.owner,
 					repo: opts.repo,
 					sha: opts.sha,
@@ -13575,7 +13591,7 @@ var init_check_run_reporter = __esmMin((() => {
 				const timer = setTimeout(() => {
 					this.progressTimers.delete(key);
 					this.flushProgress(key, opts).catch((err) => {
-						logger$144.error("Failed to flush step progress", {
+						logger$145.error("Failed to flush step progress", {
 							error: toErrorMessage(err),
 							key
 						});
@@ -13613,12 +13629,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doSetBuildPending(opts) {
 			if (opts.provider !== "github") {
-				logger$144.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$145.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$144.debug("GitHub config or installationId missing, skipping build check run", {
+				logger$145.debug("GitHub config or installationId missing, skipping build check run", {
 					hasConfig: !!githubConfig,
 					hasInstallationId: !!opts.installationId
 				});
@@ -13648,12 +13664,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doSetBuildComplete(opts) {
 			if (opts.provider !== "github") {
-				logger$144.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$145.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$144.debug("GitHub config or installationId missing, skipping build check run update");
+				logger$145.debug("GitHub config or installationId missing, skipping build check run update");
 				return;
 			}
 			const label = this.workflowLabel(opts);
@@ -13663,7 +13679,7 @@ var init_check_run_reporter = __esmMin((() => {
 			if (pending) await pending;
 			const checkRunId = await this.resolveCheckRunId(key);
 			if (!checkRunId) {
-				logger$144.warn("Check run ID not found for build update, skipping", { key });
+				logger$145.warn("Check run ID not found for build update, skipping", { key });
 				return;
 			}
 			const octokit = createInstallationOctokit(githubConfig, opts.installationId);
@@ -13716,7 +13732,7 @@ var init_check_run_reporter = __esmMin((() => {
 				};
 				default: {
 					const unexpected = status;
-					logger$144.warn("Unexpected terminal job status mapping a build conclusion", { status: unexpected });
+					logger$145.warn("Unexpected terminal job status mapping a build conclusion", { status: unexpected });
 					return {
 						conclusion: CheckRunConclusion.enum.failure,
 						description: customDescription ?? "Build finished with an unrecognised status"
@@ -13756,7 +13772,7 @@ var init_check_run_reporter = __esmMin((() => {
 				};
 				default: {
 					const unexpected = state;
-					logger$144.warn("Unexpected terminal job status mapping a job conclusion", { status: unexpected });
+					logger$145.warn("Unexpected terminal job status mapping a job conclusion", { status: unexpected });
 					return {
 						conclusion: CheckRunConclusion.enum.failure,
 						description: customDescription ?? "Job finished with an unrecognised status"
@@ -13796,7 +13812,7 @@ var init_check_run_reporter = __esmMin((() => {
 				};
 				default: {
 					const unexpected = status;
-					logger$144.warn("Unexpected terminal job status mapping a workflow conclusion", { status: unexpected });
+					logger$145.warn("Unexpected terminal job status mapping a workflow conclusion", { status: unexpected });
 					return {
 						conclusion: CheckRunConclusion.enum.failure,
 						description: customDescription ?? "Workflow finished with an unrecognised status"
@@ -13823,12 +13839,12 @@ var init_check_run_reporter = __esmMin((() => {
 				if (error.status === 403) {
 					const rateRemaining = error.response?.headers?.["x-ratelimit-remaining"];
 					const rateReset = error.response?.headers?.["x-ratelimit-reset"];
-					logger$144.error("GitHub API 403 creating check run", {
+					logger$145.error("GitHub API 403 creating check run", {
 						name: params.name,
 						rateRemaining,
 						rateReset
 					});
-				} else logger$144.error("GitHub API error creating check run", {
+				} else logger$145.error("GitHub API error creating check run", {
 					name: params.name,
 					status: error.status,
 					error: toErrorMessage(err)
@@ -13866,12 +13882,12 @@ var init_check_run_reporter = __esmMin((() => {
 				if (error.status === 403) {
 					const rateRemaining = error.response?.headers?.["x-ratelimit-remaining"];
 					const rateReset = error.response?.headers?.["x-ratelimit-reset"];
-					logger$144.error("GitHub API 403 updating check run", {
+					logger$145.error("GitHub API 403 updating check run", {
 						checkRunId: params.check_run_id,
 						rateRemaining,
 						rateReset
 					});
-				} else logger$144.error("GitHub API error updating check run", {
+				} else logger$145.error("GitHub API error updating check run", {
 					checkRunId: params.check_run_id,
 					status: error.status,
 					error: toErrorMessage(err)
@@ -13880,7 +13896,7 @@ var init_check_run_reporter = __esmMin((() => {
 			if (patchAccepted && params.status === "completed" && trackingKey && this.deps.trackingStore) try {
 				await this.deps.trackingStore.markTerminalSent(this.parseKey(trackingKey), trackingRunId);
 			} catch (err) {
-				logger$144.warn("Failed to stamp terminal_sent_at; continuing", {
+				logger$145.warn("Failed to stamp terminal_sent_at; continuing", {
 					key: trackingKey,
 					error: toErrorMessage(err)
 				});
@@ -13915,7 +13931,7 @@ function reportJobCheckRunCompletion(deps, input) {
 	try {
 		postJobCheckRunCompletion(deps, input);
 	} catch (err) {
-		logger$143.error("Failed to report job check-run completion", {
+		logger$144.error("Failed to report job check-run completion", {
 			error: toErrorMessage(err),
 			runId: input.runId,
 			jobId: input.jobId,
@@ -13927,7 +13943,7 @@ function postJobCheckRunCompletion(deps, input) {
 	if (!isTerminalJobStatus(input.status)) return;
 	const execContext = deps.getExecutionContext(input.runId);
 	if (!execContext) {
-		logger$143.debug("No execution context for job check-run completion, skipping", {
+		logger$144.debug("No execution context for job check-run completion, skipping", {
 			runId: input.runId,
 			jobId: input.jobId
 		});
@@ -13955,10 +13971,10 @@ function postJobCheckRunCompletion(deps, input) {
 		runId: input.runId
 	});
 }
-var logger$143;
+var logger$144;
 var init_job_check_run_completion = __esmMin((() => {
 	init_check_run_reporter();
-	logger$143 = createLogger({ prefix: "check-run-completion" });
+	logger$144 = createLogger({ prefix: "check-run-completion" });
 }));
 //#endregion
 //#region src/queue/terminalize-unroutable.ts
@@ -14066,7 +14082,7 @@ async function terminalizeUnroutableJob(deps, job) {
 		}
 		return job.runId;
 	} catch (err) {
-		logger$142.error("Failed to forward never-dispatched job status", {
+		logger$143.error("Failed to forward never-dispatched job status", {
 			runId: job.runId,
 			jobName: job.jobName,
 			error: toErrorMessage(err)
@@ -14074,11 +14090,11 @@ async function terminalizeUnroutableJob(deps, job) {
 		return null;
 	}
 }
-var logger$142, GENERIC_MESSAGE;
+var logger$143, GENERIC_MESSAGE;
 var init_terminalize_unroutable = __esmMin((() => {
 	init_job_check_run_completion();
 	init_agent_fit();
-	logger$142 = createLogger({ prefix: "terminalize-unroutable" });
+	logger$143 = createLogger({ prefix: "terminalize-unroutable" });
 	GENERIC_MESSAGE = "Queue timeout expired (job was never dispatched to an agent)";
 }));
 //#endregion
@@ -14235,7 +14251,7 @@ async function pruneExpiredHistory(deps) {
 			const r = await db.selectFrom("execution_runs").select(({ fn }) => fn.countAll().as("n")).where("created_at", "<", cutoff).where("status", "in", TERMINAL_RUN_STATUS_LIST).executeTakeFirst();
 			summary.pending.execution_runs = Number(r?.n ?? 0);
 		}
-		logger$141.warn("Database retention is announced but not yet deleting; the first deletion runs 7 days after the announce stamp. Set KICI_RUN_RETENTION_DAYS / KICI_AUDIT_RETENTION_DAYS / KICI_PROVENANCE_RETENTION_DAYS / KICI_HELD_RUN_RETENTION_DAYS to 0 to disable.", {
+		logger$142.warn("Database retention is announced but not yet deleting; the first deletion runs 7 days after the announce stamp. Set KICI_RUN_RETENTION_DAYS / KICI_AUDIT_RETENTION_DAYS / KICI_PROVENANCE_RETENTION_DAYS / KICI_HELD_RUN_RETENTION_DAYS to 0 to disable.", {
 			windows,
 			wouldDelete: summary.pending
 		});
@@ -14254,7 +14270,7 @@ async function pruneExpiredHistory(deps) {
 		summary.deleted.pending_attestations = await pruneByAge(db, "pending_attestations", "created_at", cutoff, batchSize);
 	}
 	if (windows.heldRunRetentionDays > 0) summary.deleted.held_runs = await pruneHeldRuns(db, cutoffFor(now, windows.heldRunRetentionDays), batchSize);
-	if (Object.values(summary.deleted).reduce((a, b) => a + b, 0) > 0) logger$141.info("Pruned expired history", {
+	if (Object.values(summary.deleted).reduce((a, b) => a + b, 0) > 0) logger$142.info("Pruned expired history", {
 		deleted: summary.deleted,
 		windows
 	});
@@ -14278,7 +14294,7 @@ async function pruneExpiredHistorySafely(deps) {
 	try {
 		return await pruneExpiredHistory(deps);
 	} catch (err) {
-		logger$141.error("Failed to prune expired history", { error: toErrorMessage(err) });
+		logger$142.error("Failed to prune expired history", { error: toErrorMessage(err) });
 		return {
 			deleted: {},
 			pending: {},
@@ -14286,11 +14302,11 @@ async function pruneExpiredHistorySafely(deps) {
 		};
 	}
 }
-var logger$141, TERMINAL_RUN_STATUS_LIST, TERMINAL_HELD_RUN_STATUSES, COLD_STORE_OWNED_TABLES;
+var logger$142, TERMINAL_RUN_STATUS_LIST, TERMINAL_HELD_RUN_STATUSES, COLD_STORE_OWNED_TABLES;
 var init_retention$1 = __esmMin((() => {
 	init_held_runs();
 	init_prometheus();
-	logger$141 = createLogger({ prefix: "retention" });
+	logger$142 = createLogger({ prefix: "retention" });
 	TERMINAL_RUN_STATUS_LIST = [...TERMINAL_RUN_STATES];
 	TERMINAL_HELD_RUN_STATUSES = [
 		"approved",
@@ -14328,37 +14344,37 @@ async function runCleanup(dedup, queue, extras) {
 	if (extras) {
 		try {
 			const pruned = await pruneRequestIdempotency(extras.db);
-			if (pruned > 0) logger$140.info("Pruned stale request idempotency claims", { pruned });
+			if (pruned > 0) logger$141.info("Pruned stale request idempotency claims", { pruned });
 		} catch (err) {
-			logger$140.error("Failed to prune request idempotency claims", { error: toErrorMessage(err) });
+			logger$141.error("Failed to prune request idempotency claims", { error: toErrorMessage(err) });
 		}
 		const ttlDays = extras.dispatchQueueTtlDays ?? 30;
 		try {
 			dispatchRowsPruned = await queue.pruneTerminalDispatchRows(ttlDays);
 			if (dispatchRowsPruned > 0) {
 				dispatchQueueRowsPrunedTotal.add(dispatchRowsPruned);
-				logger$140.info("Pruned terminal dispatch_queue rows", {
+				logger$141.info("Pruned terminal dispatch_queue rows", {
 					dispatchRowsPruned,
 					ttlDays
 				});
 			}
 		} catch (err) {
-			logger$140.error("Failed to prune terminal dispatch_queue rows", { error: toErrorMessage(err) });
+			logger$141.error("Failed to prune terminal dispatch_queue rows", { error: toErrorMessage(err) });
 		}
 		try {
 			const scrubbed = await queue.scrubTerminalSealedSecrets();
-			if (scrubbed > 0) logger$140.info("Scrubbed sealed secrets of terminal dispatch_queue rows", { scrubbed });
+			if (scrubbed > 0) logger$141.info("Scrubbed sealed secrets of terminal dispatch_queue rows", { scrubbed });
 		} catch (err) {
-			logger$140.error("Failed to scrub sealed secrets of terminal dispatch_queue rows", { error: toErrorMessage(err) });
+			logger$141.error("Failed to scrub sealed secrets of terminal dispatch_queue rows", { error: toErrorMessage(err) });
 		}
 		if (extras.logStorage && extras.logStorageIsS3) try {
 			logObjectsPruned = await pruneExpiredLogs(extras.logStorage, extras.stepLogTtlDays ?? 90);
 			if (logObjectsPruned > 0) {
 				stepLogsPrunedTotal.add(logObjectsPruned);
-				logger$140.info("Pruned expired step-log objects", { logObjectsPruned });
+				logger$141.info("Pruned expired step-log objects", { logObjectsPruned });
 			}
 		} catch (err) {
-			logger$140.error("Failed to prune expired step-log objects", { error: toErrorMessage(err) });
+			logger$141.error("Failed to prune expired step-log objects", { error: toErrorMessage(err) });
 		}
 		if (extras.checkRunTrackingStore) {
 			const checkRunTtlDefault = extras.checkRunTrackingTtlDays ?? 7;
@@ -14367,13 +14383,13 @@ async function runCleanup(dedup, queue, extras) {
 				checkRunRowsPruned = await extras.checkRunTrackingStore.pruneStale(ttlDays);
 				if (checkRunRowsPruned > 0) {
 					checkRunTrackingRowsPrunedTotal.add(checkRunRowsPruned);
-					logger$140.info("Pruned stale check-run-tracking rows", {
+					logger$141.info("Pruned stale check-run-tracking rows", {
 						checkRunRowsPruned,
 						ttlDays
 					});
 				}
 			} catch (err) {
-				logger$140.error("Failed to prune stale check-run-tracking rows", { error: toErrorMessage(err) });
+				logger$141.error("Failed to prune stale check-run-tracking rows", { error: toErrorMessage(err) });
 			}
 		}
 		if (extras.retentionWindows) {
@@ -14401,20 +14417,20 @@ async function runCleanup(dedup, queue, extras) {
 		for (const runId of affectedRunIds) try {
 			await extras.executionTracker.completeRunIfAllJobsTerminal(runId);
 		} catch (err) {
-			logger$140.error("Error checking run completion after queue expiry", {
+			logger$141.error("Error checking run completion after queue expiry", {
 				runId,
 				error: toErrorMessage(err)
 			});
 		}
 	}
-	if (dedupDeleted > 0 || queueExpired > 0 || dispatchRowsPruned > 0 || logObjectsPruned > 0 || checkRunRowsPruned > 0) logger$140.info("Cleanup completed", {
+	if (dedupDeleted > 0 || queueExpired > 0 || dispatchRowsPruned > 0 || logObjectsPruned > 0 || checkRunRowsPruned > 0) logger$141.info("Cleanup completed", {
 		dedupDeleted,
 		queueExpired,
 		dispatchRowsPruned,
 		logObjectsPruned,
 		checkRunRowsPruned
 	});
-	else logger$140.debug("Cleanup completed, nothing to clean");
+	else logger$141.debug("Cleanup completed, nothing to clean");
 	return {
 		dedupDeleted,
 		queueExpired,
@@ -14433,14 +14449,14 @@ function createCleanupHandler(dedup, queue, extras) {
 		await runCleanup(dedup, queue, extras);
 	};
 }
-var logger$140;
+var logger$141;
 var init_cleanup$1 = __esmMin((() => {
 	init_log_retention();
 	init_request_idempotency();
 	init_prometheus();
 	init_terminalize_unroutable();
 	init_retention$1();
-	logger$140 = createLogger({ prefix: "cleanup" });
+	logger$141 = createLogger({ prefix: "cleanup" });
 }));
 //#endregion
 //#region src/queue/unroutable-probe.ts
@@ -14482,7 +14498,7 @@ function createUnroutableProbeHandler(deps) {
 				if (job.unroutableSince !== null) {
 					await deps.queue.clearUnroutableState(job.id);
 					await deps.setRoutingReason(job.runId, job.jobName, null);
-					logger$139.info("Job became routable again; cleared unroutable state", {
+					logger$140.info("Job became routable again; cleared unroutable state", {
 						runId: job.runId,
 						jobName: job.jobName
 					});
@@ -14492,7 +14508,7 @@ function createUnroutableProbeHandler(deps) {
 			if (job.unroutableSince === null) {
 				await deps.queue.markUnroutableSince(job.id, new Date(now));
 				await deps.setRoutingReason(job.runId, job.jobName, verdict.errorMessage);
-				logger$139.warn("Job is unroutable; starting grace window", {
+				logger$140.warn("Job is unroutable; starting grace window", {
 					runId: job.runId,
 					jobName: job.jobName,
 					graceMs,
@@ -14504,7 +14520,7 @@ function createUnroutableProbeHandler(deps) {
 				if (!await deps.queue.claimUnroutable(job.id)) continue;
 				await deps.terminalize(job);
 				deps.onFastFailed?.();
-				logger$139.warn("Job stayed unroutable for the whole grace window; failed it", {
+				logger$140.warn("Job stayed unroutable for the whole grace window; failed it", {
 					runId: job.runId,
 					jobName: job.jobName,
 					graceMs
@@ -14513,10 +14529,10 @@ function createUnroutableProbeHandler(deps) {
 		}
 	};
 }
-var logger$139, TICK_FLOOR_MS, TICK_CEILING_MS, DEFAULT_BATCH_LIMIT$1, DEFAULT_UNROUTABLE_GRACE_MS;
+var logger$140, TICK_FLOOR_MS, TICK_CEILING_MS, DEFAULT_BATCH_LIMIT$1, DEFAULT_UNROUTABLE_GRACE_MS;
 var init_unroutable_probe = __esmMin((() => {
 	init_terminalize_unroutable();
-	logger$139 = createLogger({ prefix: "unroutable-probe" });
+	logger$140 = createLogger({ prefix: "unroutable-probe" });
 	TICK_FLOOR_MS = 5e3;
 	TICK_CEILING_MS = 3e4;
 	DEFAULT_BATCH_LIMIT$1 = 200;
@@ -14623,7 +14639,7 @@ function registerOrchestratorScheduledJob(opts) {
 		inFlight = (async () => {
 			const startedAt = Date.now();
 			try {
-				logger$138.info("Scheduled job starting", { job: opts.name });
+				logger$139.info("Scheduled job starting", { job: opts.name });
 				await opts.handler();
 				const durationMs = Date.now() - startedAt;
 				const durationSeconds = durationMs / 1e3;
@@ -14637,7 +14653,7 @@ function registerOrchestratorScheduledJob(opts) {
 				const entry = jobMetricState.get(opts.name);
 				entry.consecutiveFailures = 0;
 				entry.lastSuccessAt = /* @__PURE__ */ new Date();
-				logger$138.info("Scheduled job completed", {
+				logger$139.info("Scheduled job completed", {
 					job: opts.name,
 					durationMs
 				});
@@ -14659,12 +14675,12 @@ function registerOrchestratorScheduledJob(opts) {
 				entry.consecutiveFailures += 1;
 				entry.lastFailureAt = /* @__PURE__ */ new Date();
 				jobConsecutiveFailures.set({ job: opts.name }, entry.consecutiveFailures);
-				logger$138.error("Scheduled job failed", {
+				logger$139.error("Scheduled job failed", {
 					job: opts.name,
 					durationMs,
 					error: errMsg
 				});
-				if (opts.db) writeFailureAccessLog(opts, errMsg).catch((auditErr) => logger$138.error("Failed to write access_log for scheduled-job failure", {
+				if (opts.db) writeFailureAccessLog(opts, errMsg).catch((auditErr) => logger$139.error("Failed to write access_log for scheduled-job failure", {
 					job: opts.name,
 					error: toErrorMessage(auditErr)
 				}));
@@ -14681,10 +14697,10 @@ function registerOrchestratorScheduledJob(opts) {
 	}
 	const timer = setInterval(() => {
 		if (stopped) return;
-		runDetached(logger$138, "Scheduled job run", () => runOnce(), { job: opts.name });
+		runDetached(logger$139, "Scheduled job run", () => runOnce(), { job: opts.name });
 	}, opts.intervalMs);
 	if (opts.unref !== false) timer.unref();
-	if (opts.runOnStart === true) runDetached(logger$138, "Scheduled job run", () => runOnce(), { job: opts.name });
+	if (opts.runOnStart === true) runDetached(logger$139, "Scheduled job run", () => runOnce(), { job: opts.name });
 	const handle = {
 		name: opts.name,
 		stop() {
@@ -14698,7 +14714,7 @@ function registerOrchestratorScheduledJob(opts) {
 		}
 	};
 	handleRegistry.set(opts.name, handle);
-	logger$138.info("Scheduled job registered", {
+	logger$139.info("Scheduled job registered", {
 		job: opts.name,
 		intervalMs: opts.intervalMs,
 		runOnStart: opts.runOnStart === true
@@ -14722,11 +14738,11 @@ async function writeFailureAccessLog(opts, errorMessage) {
 		error_message: errorMessage
 	}).execute();
 }
-var logger$138, OrchestratorScheduledJobName, ACCESS_LOG_ACTION_TICK_FAILURE, ACCESS_LOG_ACTION_TRIGGER, jobMetricState, handleRegistry;
+var logger$139, OrchestratorScheduledJobName, ACCESS_LOG_ACTION_TICK_FAILURE, ACCESS_LOG_ACTION_TRIGGER, jobMetricState, handleRegistry;
 var init_scheduled_job = __esmMin((() => {
 	init_scheduled_jobs();
 	init_run_detached();
-	logger$138 = createLogger({ prefix: "scheduled-job" });
+	logger$139 = createLogger({ prefix: "scheduled-job" });
 	OrchestratorScheduledJobName = z.enum([
 		"cleanup",
 		"orphan-secret-cleanup",
@@ -15338,13 +15354,13 @@ async function loadAccessLogRange(args) {
 		}
 	} catch (err) {
 		if (cursor?.source === "cold") {
-			logger$137.error("cold-store fetchRange failed during cold-resume; propagating", {
+			logger$138.error("cold-store fetchRange failed during cold-resume; propagating", {
 				tenantId: tenantToScan,
 				error: toErrorMessage(err)
 			});
 			throw err;
 		}
-		logger$137.warn("cold-store fetchRange failed; returning hot rows only", {
+		logger$138.warn("cold-store fetchRange failed; returning hot rows only", {
 			tenantId: tenantToScan,
 			error: toErrorMessage(err)
 		});
@@ -15418,9 +15434,9 @@ function parseCursor$2(cursor) {
 		return null;
 	}
 }
-var logger$137, SYNTHETIC_ORCH_TENANT;
+var logger$138, SYNTHETIC_ORCH_TENANT;
 var init_load_access_log_range = __esmMin((() => {
-	logger$137 = createLogger({ prefix: "load-access-log-range" });
+	logger$138 = createLogger({ prefix: "load-access-log-range" });
 	SYNTHETIC_ORCH_TENANT = "__orchestrator__";
 }));
 //#endregion
@@ -16282,9 +16298,9 @@ var init_depth_refresher = __esmMin((() => {
 function payloadFromObject(payload) {
 	return { raw: Buffer.from(JSON.stringify(payload), "utf-8") };
 }
-var logger$136, EventLogWriter;
+var logger$137, EventLogWriter;
 var init_event_log = __esmMin((() => {
-	logger$136 = createLogger({ prefix: "event-log" });
+	logger$137 = createLogger({ prefix: "event-log" });
 	EventLogWriter = class EventLogWriter {
 		db;
 		logStorage;
@@ -16321,7 +16337,7 @@ var init_event_log = __esmMin((() => {
 			if (sizeBytes > maxBytes) {
 				payloadOmitted = true;
 				payloadOmittedReason = PayloadOmittedReason.enum.size_exceeded;
-				logger$136.warn("Webhook payload exceeds soft cap; recording metadata only", {
+				logger$137.warn("Webhook payload exceeds soft cap; recording metadata only", {
 					deliveryId: info.deliveryId,
 					sizeBytes,
 					maxBytes
@@ -16335,7 +16351,7 @@ var init_event_log = __esmMin((() => {
 				} catch (err) {
 					payloadOmitted = true;
 					payloadOmittedReason = PayloadOmittedReason.enum.storage_failed;
-					logger$136.error("Failed to upload event-log payload to object storage", {
+					logger$137.error("Failed to upload event-log payload to object storage", {
 						deliveryId: info.deliveryId,
 						orgId: outcome.orgId,
 						error: toErrorMessage(err)
@@ -16376,7 +16392,7 @@ var init_event_log = __esmMin((() => {
 					});
 				}).execute();
 			} catch (err) {
-				logger$136.error("Failed to record event_log row", {
+				logger$137.error("Failed to record event_log row", {
 					deliveryId: info.deliveryId,
 					orgId: outcome.orgId,
 					error: toErrorMessage(err)
@@ -16430,11 +16446,11 @@ var init_sampling_rate_limiter = __esmMin((() => {
 }));
 //#endregion
 //#region src/audit/access-log.ts
-var logger$135, AccessLogWriter;
+var logger$136, AccessLogWriter;
 var init_access_log = __esmMin((() => {
 	init_load_access_log_range();
 	init_sampling_rate_limiter();
-	logger$135 = createLogger({ prefix: "access-log" });
+	logger$136 = createLogger({ prefix: "access-log" });
 	AccessLogWriter = class {
 		db;
 		coldStore;
@@ -16455,7 +16471,7 @@ var init_access_log = __esmMin((() => {
 			try {
 				await this.insert(this.db, entry);
 			} catch (err) {
-				logger$135.error("access_log record failed", {
+				logger$136.error("access_log record failed", {
 					error: toErrorMessage(err),
 					action: entry.action,
 					source: entry.source
@@ -16552,7 +16568,7 @@ var init_access_log = __esmMin((() => {
 					fromTs: /* @__PURE__ */ new Date(0)
 				})) if (String(row.id) === id) return toAccessLogItem(row);
 			} catch (err) {
-				logger$135.warn("cold-store fetchRange failed for access-log getById", {
+				logger$136.warn("cold-store fetchRange failed for access-log getById", {
 					id,
 					tenantId,
 					error: toErrorMessage(err)
@@ -16629,14 +16645,14 @@ async function storeWebhookPayload(args) {
 	const backend = logStorage.constructor.name;
 	try {
 		await logStorage.append(payloadPath, payloadBytes);
-		logger$134.info("Stored webhook payload for run", {
+		logger$135.info("Stored webhook payload for run", {
 			runId,
 			payloadPath,
 			bytes: payloadBytes.length,
 			logStorageBackend: backend
 		});
 	} catch (err) {
-		logger$134.error("Failed to store webhook payload", {
+		logger$135.error("Failed to store webhook payload", {
 			runId,
 			payloadPath,
 			bytes: payloadBytes.length,
@@ -16645,9 +16661,9 @@ async function storeWebhookPayload(args) {
 		});
 	}
 }
-var logger$134;
+var logger$135;
 var init_webhook_payload_store = __esmMin((() => {
-	logger$134 = createLogger({ prefix: "pipeline" });
+	logger$135 = createLogger({ prefix: "pipeline" });
 }));
 //#endregion
 //#region src/db/synthetic-job-ids.ts
@@ -16775,7 +16791,7 @@ async function runInvokeGate(deps, args) {
 	const reservedPrefix = reservedEventNamePrefix(event);
 	if (reservedPrefix) {
 		await deps.executionTracker.onJobStatus(runId, gateJobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, { error: reservedEventMessage(event, reservedPrefix) });
-		logger$133.warn("Invoke gate refused: reserved event-name prefix", {
+		logger$134.warn("Invoke gate refused: reserved event-name prefix", {
 			runId,
 			gateJobName,
 			event,
@@ -16785,7 +16801,7 @@ async function runInvokeGate(deps, args) {
 	}
 	if (args.chainDepth >= deps.maxChainDepth) {
 		await deps.executionTracker.onJobStatus(runId, gateJobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, { error: `invoke chain depth ${args.chainDepth} reached the bound ${deps.maxChainDepth}; refusing to summon ${event}` });
-		logger$133.warn("Invoke gate refused: chain depth bound reached", {
+		logger$134.warn("Invoke gate refused: chain depth bound reached", {
 			runId,
 			gateJobName,
 			event,
@@ -16806,7 +16822,7 @@ async function runInvokeGate(deps, args) {
 	} catch (err) {
 		const reason = err instanceof SummonRefusedError ? err.message : `invoke gate summon failed: ${toErrorMessage(err)}`;
 		await deps.executionTracker.onJobStatus(runId, gateJobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, { error: reason });
-		logger$133.error("Invoke gate summon refused or failed", {
+		logger$134.error("Invoke gate summon refused or failed", {
 			runId,
 			gateJobName,
 			event,
@@ -16820,7 +16836,7 @@ async function runInvokeGate(deps, args) {
 		return;
 	}
 	await createProxies(deps, args, runs);
-	logger$133.info("Invoke gate summoned subscribers", {
+	logger$134.info("Invoke gate summoned subscribers", {
 		runId,
 		gateJobName,
 		event,
@@ -16837,7 +16853,7 @@ async function runInvokeGate(deps, args) {
 async function releaseInvokeGate(deps, runId, gateJobName, params) {
 	const runRow = await deps.db.selectFrom("execution_runs").select(["repo_identifier", "chain_depth"]).where("run_id", "=", runId).executeTakeFirst();
 	if (!runRow) {
-		logger$133.warn("Invoke gate release: run not found; cannot summon", {
+		logger$134.warn("Invoke gate release: run not found; cannot summon", {
 			runId,
 			gateJobName
 		});
@@ -16858,7 +16874,7 @@ async function releaseInvokeGate(deps, runId, gateJobName, params) {
 		needs_satisfied: true,
 		ready_at: /* @__PURE__ */ new Date()
 	}).where("run_id", "=", runId).where("job_id", "=", gateJobId).execute();
-	logger$133.info("Invoke gate ready; summoning source-repo subscribers", {
+	logger$134.info("Invoke gate ready; summoning source-repo subscribers", {
 		runId,
 		gateJobName,
 		event: params.event,
@@ -16884,7 +16900,7 @@ async function handleZeroSubscribers(deps, args) {
 	const { runId, gateJobId, gateJobName, event, sourceRepo, optional } = args;
 	if (optional) {
 		await deps.executionTracker.onJobStatus(runId, gateJobId, ExecutionJobStatus.enum.success, Date.now());
-		logger$133.info("Invoke gate skipped: zero subscribers, optional", {
+		logger$134.info("Invoke gate skipped: zero subscribers, optional", {
 			runId,
 			gateJobName,
 			event
@@ -16892,7 +16908,7 @@ async function handleZeroSubscribers(deps, args) {
 		return;
 	}
 	await deps.executionTracker.onJobStatus(runId, gateJobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, { error: zeroSubscriberMessage(sourceRepo, event) });
-	logger$133.warn("Invoke gate failed: zero subscribers, required", {
+	logger$134.warn("Invoke gate failed: zero subscribers, required", {
 		runId,
 		gateJobName,
 		event
@@ -16925,10 +16941,10 @@ async function createProxies(deps, args, runs) {
 		await deps.executionTracker.reconcileSummonedRunIfTerminal(runs[i].runId);
 	}
 }
-var logger$133, SummonRefusedError;
+var logger$134, SummonRefusedError;
 var init_invoke_gate = __esmMin((() => {
 	init_types$2();
-	logger$133 = createLogger({ prefix: "invoke-gate" });
+	logger$134 = createLogger({ prefix: "invoke-gate" });
 	SummonRefusedError = class extends Error {
 		constructor(reason) {
 			super(reason);
@@ -17087,7 +17103,7 @@ async function releaseQueuedHolds(args) {
 		await onJobRelease(await heldRunStore.release(orgId, hold.id));
 		resumed++;
 	} catch (err) {
-		logger$132.error("Failed to resume a released queued hold", {
+		logger$133.error("Failed to resume a released queued hold", {
 			holdId: hold.id,
 			runId: hold.run_id,
 			jobId: hold.job_id,
@@ -17095,7 +17111,7 @@ async function releaseQueuedHolds(args) {
 			error: toErrorMessage(err)
 		});
 	}
-	if (resumed > 0) logger$132.info("Released queued concurrency holds", {
+	if (resumed > 0) logger$133.info("Released queued concurrency holds", {
 		concurrencyGroup,
 		resumed,
 		queued: queued.length,
@@ -17103,10 +17119,10 @@ async function releaseQueuedHolds(args) {
 	});
 	return resumed;
 }
-var logger$132;
+var logger$133;
 var init_release_queued_holds = __esmMin((() => {
 	init_synthetic_job_ids();
-	logger$132 = createLogger({ prefix: "release-queued-holds" });
+	logger$133 = createLogger({ prefix: "release-queued-holds" });
 }));
 //#endregion
 //#region src/contexts/protection/branch-gate.ts
@@ -17845,7 +17861,7 @@ async function warnUnboundJobContexts(args) {
 		} catch {
 			continue;
 		}
-		if (bindings === 0) logger$131.warn(UNBOUND_JOB_CONTEXT_MESSAGE, {
+		if (bindings === 0) logger$132.warn(UNBOUND_JOB_CONTEXT_MESSAGE, {
 			orgId,
 			context: name,
 			contextId: env.id,
@@ -17855,9 +17871,9 @@ async function warnUnboundJobContexts(args) {
 		});
 	}
 }
-var logger$131, UNBOUND_JOB_CONTEXT_MESSAGE;
+var logger$132, UNBOUND_JOB_CONTEXT_MESSAGE;
 var init_unbound_job_context = __esmMin((() => {
-	logger$131 = createLogger({ prefix: "job-contexts" });
+	logger$132 = createLogger({ prefix: "job-contexts" });
 	UNBOUND_JOB_CONTEXT_MESSAGE = "Job binds a context that has no scope binding; it receives no secrets from it";
 }));
 //#endregion
@@ -17917,7 +17933,7 @@ async function resolveRegistryAuthInto(args) {
 	const { container, dispatchCtx, trustTier, admittedContextIds } = registryAuth;
 	if (isUntrustedTier(trustTier)) {
 		containerRegistryAuthContributorStrippedTotal.add(1, { trust_tier: trustTier ?? "unknown" });
-		logger$130.info("Container registry auth withheld from an untrusted contributor", {
+		logger$131.info("Container registry auth withheld from an untrusted contributor", {
 			...log,
 			trustTier: trustTier ?? "unknown"
 		});
@@ -17948,7 +17964,7 @@ async function resolveRegistryAuthInto(args) {
 		} });
 	} catch (err) {
 		if ((registryAuth.onRefusal ?? "throw") === "throw" || lookupFailure !== void 0) throw err;
-		logger$130.warn("Container registry auth refused; dispatching without it", {
+		logger$131.warn("Container registry auth refused; dispatching without it", {
 			...log,
 			error: toErrorMessage(err)
 		});
@@ -18041,7 +18057,7 @@ async function resolveReleasedJobInput(args) {
 	});
 	const jobConfig = jobInput.jobConfig;
 	const fields = contextDataConfigFields(data, jobConfig.secrets);
-	logger$130.info("Resolved context data for a released job", {
+	logger$131.info("Resolved context data for a released job", {
 		...log,
 		contexts: entries.map((e) => e.name)
 	});
@@ -18056,7 +18072,7 @@ async function resolveReleasedJobInput(args) {
 /** Log a release-time resolution failure; the caller fails the job. */
 function logReleaseResolutionFailure(jobInput, err) {
 	const message = `context data could not be resolved on release: ${toErrorMessage(err)}`;
-	logger$130.error("Released job failed: context data resolution", {
+	logger$131.error("Released job failed: context data resolution", {
 		runId: jobInput.runId,
 		workflow: jobInput.workflowName,
 		job: jobInput.jobName,
@@ -18064,7 +18080,7 @@ function logReleaseResolutionFailure(jobInput, err) {
 	});
 	return message;
 }
-var logger$130, DeferredContextResolutionSchema, CONTEXT_DATA_CONFIG_KEYS;
+var logger$131, DeferredContextResolutionSchema, CONTEXT_DATA_CONFIG_KEYS;
 var init_held_context_data = __esmMin((() => {
 	init_context_store();
 	init_prometheus();
@@ -18073,7 +18089,7 @@ var init_held_context_data = __esmMin((() => {
 	init_trust_tier();
 	init_job_contexts();
 	init_unbound_job_context();
-	logger$130 = createLogger({ prefix: "held-context-data" });
+	logger$131 = createLogger({ prefix: "held-context-data" });
 	DeferredContextResolutionSchema = z.object({
 		/**
 		* The contexts that admitted the job's reject rules, in merge order. The id
@@ -19130,9 +19146,9 @@ var init_commit_message = __esmMin((() => {}));
 * webhook normalization, lock file fetching, changed files retrieval,
 * clone token creation, and URL building.
 */
-var logger$129, ProviderRegistry;
+var logger$130, ProviderRegistry;
 var init_provider_registry = __esmMin((() => {
-	logger$129 = createLogger({ prefix: "provider-registry" });
+	logger$130 = createLogger({ prefix: "provider-registry" });
 	ProviderRegistry = class {
 		bundles = /* @__PURE__ */ new Map();
 		registerByRoutingKey(routingKey, bundle) {
@@ -19185,7 +19201,7 @@ var init_provider_registry = __esmMin((() => {
 		*/
 		unregister(routingKey) {
 			const existed = this.bundles.delete(routingKey);
-			if (existed) logger$129.info("Provider bundle unregistered", { routingKey });
+			if (existed) logger$130.info("Provider bundle unregistered", { routingKey });
 			return existed;
 		}
 		/**
@@ -19200,7 +19216,7 @@ var init_provider_registry = __esmMin((() => {
 		clear() {
 			const count = this.bundles.size;
 			this.bundles.clear();
-			if (count > 0) logger$129.info("Provider registry cleared", { previousCount: count });
+			if (count > 0) logger$130.info("Provider registry cleared", { previousCount: count });
 		}
 	};
 }));
@@ -19459,7 +19475,7 @@ var init_resume_router = __esmMin((() => {}));
 function findIdentityLink(identityLinks, provider, providerUsername, providerUserId) {
 	if (providerUserId === void 0 || providerUserId.length === 0) {
 		trustMatchRefusedNoIdTotal.add(1, { reason: "event_missing" });
-		logger$128.warn("Trust match refused: webhook event has no provider numeric id", {
+		logger$129.warn("Trust match refused: webhook event has no provider numeric id", {
 			provider,
 			providerUsername
 		});
@@ -19471,7 +19487,7 @@ function findIdentityLink(identityLinks, provider, providerUsername, providerUse
 	if (byUsername) {
 		const reason = byUsername.providerUserId === null || byUsername.providerUserId === void 0 ? "link_missing" : "id_mismatch";
 		trustMatchRefusedNoIdTotal.add(1, { reason });
-		logger$128.warn("Trust match refused: numeric id missing on link or did not match event", {
+		logger$129.warn("Trust match refused: numeric id missing on link or did not match event", {
 			provider,
 			providerUsername,
 			providerUserId,
@@ -19481,10 +19497,10 @@ function findIdentityLink(identityLinks, provider, providerUsername, providerUse
 	}
 	return null;
 }
-var logger$128;
+var logger$129;
 var init_identity_link = __esmMin((() => {
 	init_prometheus();
-	logger$128 = createLogger({ prefix: "identity-link" });
+	logger$129 = createLogger({ prefix: "identity-link" });
 }));
 //#endregion
 //#region src/pipeline/security-hold-check.ts
@@ -19672,7 +19688,7 @@ async function settleSecurityHoldCheck(args) {
 			excludeHoldIds: [hold.id, ...args.excludeHoldIds ?? []]
 		});
 		if (contender) {
-			logger$127.info("Left the security check pending: another hold on the commit still owns it", {
+			logger$128.info("Left the security check pending: another hold on the commit still owns it", {
 				runId: hold.run_id,
 				holdId: hold.id,
 				contendingHoldId: contender
@@ -19696,7 +19712,7 @@ async function settleSecurityHoldCheck(args) {
 			commit
 		};
 	} catch (err) {
-		logger$127.warn("Failed to complete the security check run of an ended hold", {
+		logger$128.warn("Failed to complete the security check run of an ended hold", {
 			runId: hold.run_id,
 			holdId: hold.id,
 			error: toErrorMessage(err)
@@ -19745,9 +19761,9 @@ async function findPendingCheckOwner(db, args) {
 	}
 	return null;
 }
-var logger$127, HOLD_OUTCOME_CONCLUSION, HOLD_OUTCOME_TITLE, PUSH_AGAIN;
+var logger$128, HOLD_OUTCOME_CONCLUSION, HOLD_OUTCOME_TITLE, PUSH_AGAIN;
 var init_security_hold_check = __esmMin((() => {
-	logger$127 = createLogger({ prefix: "security-hold-check" });
+	logger$128 = createLogger({ prefix: "security-hold-check" });
 	HOLD_OUTCOME_CONCLUSION = {
 		["approved"]: CheckRunConclusion.enum.success,
 		["rejected"]: CheckRunConclusion.enum.cancelled,
@@ -19818,14 +19834,14 @@ async function handleApprovalComment(params) {
 	const { commentBody, commenterUsername, commenterUserId, provider, repoIdentifier, prNumber, orgId, identityLinks, orgMemberPermissions, heldRunStore } = params;
 	const command = parseKiciCommand(commentBody);
 	if (!command) return { handled: false };
-	logger$126.info("Processing /kici command", {
+	logger$127.info("Processing /kici command", {
 		action: command.action,
 		commenter: commenterUsername,
 		runId: command.runId
 	});
 	const identityLink = findIdentityLink(identityLinks, provider, commenterUsername, commenterUserId);
 	if (!identityLink) {
-		logger$126.info("No identity link for commenter", {
+		logger$127.info("No identity link for commenter", {
 			commenter: commenterUsername,
 			provider
 		});
@@ -19836,7 +19852,7 @@ async function handleApprovalComment(params) {
 	}
 	const ciTrustLevel = orgMemberPermissions.get(identityLink.userId) ?? "none";
 	if (ciTrustLevel !== "write" && ciTrustLevel !== "admin") {
-		logger$126.info("Insufficient ci_trust level", {
+		logger$127.info("Insufficient ci_trust level", {
 			commenter: commenterUsername,
 			userId: identityLink.userId,
 			ciTrustLevel
@@ -19848,7 +19864,7 @@ async function handleApprovalComment(params) {
 	}
 	const pendingHolds = await heldRunStore.listPendingSecurityHoldsForPr(orgId, repoIdentifier, prNumber);
 	if (pendingHolds.length === 0) {
-		logger$126.info("No pending security holds found for PR", {
+		logger$127.info("No pending security holds found for PR", {
 			orgId,
 			repoIdentifier,
 			prNumber
@@ -19857,7 +19873,7 @@ async function handleApprovalComment(params) {
 	}
 	const targetHolds = command.runId ? pendingHolds.filter((h) => h.run_id === command.runId) : pendingHolds;
 	if (targetHolds.length === 0) {
-		logger$126.info("No matching security holds found", {
+		logger$127.info("No matching security holds found", {
 			orgId,
 			runId: command.runId
 		});
@@ -19867,7 +19883,7 @@ async function handleApprovalComment(params) {
 	for (const hold of targetHolds) try {
 		if (approved) {
 			await heldRunStore.approveByQueueType(orgId, hold.id, identityLink.userId, "security");
-			logger$126.info("Security hold approved", {
+			logger$127.info("Security hold approved", {
 				heldRunId: hold.id,
 				runId: hold.run_id,
 				approvedBy: identityLink.userId
@@ -19884,7 +19900,7 @@ async function handleApprovalComment(params) {
 				onJobRelease: params.onJobRelease,
 				onWorkflowRelease: params.onWorkflowRelease
 			}).catch((err) => {
-				logger$126.error("Failed to resume a held run after its security hold was approved", {
+				logger$127.error("Failed to resume a held run after its security hold was approved", {
 					heldRunId: hold.id,
 					runId: hold.run_id,
 					jobId: hold.job_id,
@@ -19895,7 +19911,7 @@ async function handleApprovalComment(params) {
 		} else {
 			const rejectReason = `Rejected by ${commenterUsername} via ${REJECT_COMMAND}`;
 			await heldRunStore.reject(orgId, hold.id, rejectReason);
-			logger$126.info("Security hold rejected", {
+			logger$127.info("Security hold rejected", {
 				heldRunId: hold.id,
 				runId: hold.run_id,
 				rejectedBy: commenterUsername
@@ -19904,7 +19920,7 @@ async function handleApprovalComment(params) {
 			if (hold.hold_scope === HoldScope.enum.workflow && params.onWorkflowReject) await params.onWorkflowReject(hold, rejectReason).then((posted) => {
 				securityCheckWritten = posted;
 			}).catch((err) => {
-				logger$126.error("Failed to cancel a held run after its security hold was rejected", {
+				logger$127.error("Failed to cancel a held run after its security hold was rejected", {
 					heldRunId: hold.id,
 					runId: hold.run_id,
 					error: toErrorMessage(err)
@@ -19919,7 +19935,7 @@ async function handleApprovalComment(params) {
 			});
 		}
 	} catch (err) {
-		logger$126.error("Failed to process security hold", {
+		logger$127.error("Failed to process security hold", {
 			heldRunId: hold.id,
 			action: command.action,
 			error: toErrorMessage(err)
@@ -19927,12 +19943,12 @@ async function handleApprovalComment(params) {
 	}
 	return { handled: true };
 }
-var logger$126, APPROVE_COMMAND, REJECT_COMMAND;
+var logger$127, APPROVE_COMMAND, REJECT_COMMAND;
 var init_comment_handler = __esmMin((() => {
 	init_resume_router();
 	init_identity_link();
 	init_security_hold_check();
-	logger$126 = createLogger({ prefix: "comment-handler" });
+	logger$127 = createLogger({ prefix: "comment-handler" });
 	APPROVE_COMMAND = "/kici approve";
 	REJECT_COMMAND = "/kici reject";
 }));
@@ -20052,12 +20068,12 @@ async function dispatchGlobalCandidateViaPipeline(args) {
 		sourceRepo: args.sourceRepoIdentifier
 	};
 	if (args.resolved.jobs.length === 0) {
-		logger$125.warn("Organization-wide workflow cleared with no jobs to dispatch", logFields);
+		logger$126.warn("Organization-wide workflow cleared with no jobs to dispatch", logFields);
 		return;
 	}
 	const workflowBundle = args.deps.providerRegistry.getByRoutingKey(reg.routingKey);
 	if (!workflowBundle) {
-		logger$125.warn("Global workflow skipped: no provider bundle for its workflow repository", {
+		logger$126.warn("Global workflow skipped: no provider bundle for its workflow repository", {
 			...logFields,
 			workflowRoutingKey: reg.routingKey
 		});
@@ -20067,7 +20083,7 @@ async function dispatchGlobalCandidateViaPipeline(args) {
 	try {
 		workflowCredentials = await mintWorkflowRepoCredentials(workflowBundle, reg);
 	} catch (err) {
-		logger$125.warn("Global workflow skipped: cannot mint credentials for its workflow repository", {
+		logger$126.warn("Global workflow skipped: cannot mint credentials for its workflow repository", {
 			...logFields,
 			error: toErrorMessage(err)
 		});
@@ -20113,10 +20129,10 @@ async function dispatchGlobalCandidateViaPipeline(args) {
 	});
 	return runId;
 }
-var logger$125, UNKNOWN_SOURCE_FILE;
+var logger$126, UNKNOWN_SOURCE_FILE;
 var init_global_dispatch = __esmMin((() => {
 	init_dispatch_matched_workflow();
-	logger$125 = createLogger({ prefix: "global-dispatch" });
+	logger$126 = createLogger({ prefix: "global-dispatch" });
 	UNKNOWN_SOURCE_FILE = ".kici/workflows/unknown.ts";
 }));
 //#endregion
@@ -20152,7 +20168,7 @@ async function completeUndispatchedHoldChecks(args) {
 		if (!pending) return;
 		const [owner, repo] = pending.repoIdentifier.split("/");
 		if (!owner || !repo) {
-			logger$124.warn("Cannot complete hold check runs: repo identifier is not owner/repo", {
+			logger$125.warn("Cannot complete hold check runs: repo identifier is not owner/repo", {
 				runId,
 				repoIdentifier: pending.repoIdentifier
 			});
@@ -20172,16 +20188,16 @@ async function completeUndispatchedHoldChecks(args) {
 			summary: args.summary
 		});
 	} catch (err) {
-		logger$124.warn("Failed to complete check runs for an undispatched hold", {
+		logger$125.warn("Failed to complete check runs for an undispatched hold", {
 			runId,
 			error: toErrorMessage(err)
 		});
 	}
 }
-var logger$124;
+var logger$125;
 var init_undispatched_hold_checks = __esmMin((() => {
 	init_pending_workflow_context();
-	logger$124 = createLogger({ prefix: "undispatched-hold-checks" });
+	logger$125 = createLogger({ prefix: "undispatched-hold-checks" });
 }));
 //#endregion
 //#region src/cache/global-eval-round-cache.ts
@@ -20295,13 +20311,17 @@ var KEY_SEPARATOR$1, GlobalEvalRoundCache, init_global_eval_round_cache = __esmM
 		}
 	};
 }));
-var init_replay_chunker = __esmMin((() => {})), init_event_buffer = __esmMin((() => {})), init_relay_buffer = __esmMin((() => {
+var init_replay_chunker = __esmMin((() => {}));
+var init_outbound_frame_guard = __esmMin((() => {
+	createLogger({ prefix: "platform-client" });
+})), init_event_buffer = __esmMin((() => {})), init_relay_buffer = __esmMin((() => {
 	createLogger({ prefix: "relay-buffer" });
 })), ADMITTED_PIPELINE_LIFETIME_MS, DASHBOARD_FRAME_TYPES;
 var init_platform_client = __esmMin((() => {
 	init_replay_chunker();
 	init_prometheus();
 	init_run_detached();
+	init_outbound_frame_guard();
 	init_event_buffer();
 	init_relay_buffer();
 	createLogger({ prefix: "platform-client" });
@@ -20726,22 +20746,6 @@ function roundDecidedNothing(verdicts) {
 	const collected = [...verdicts.values()];
 	return collected.length > 0 && collected.every((verdict) => verdict.indeterminate === true);
 }
-/**
-* Truncate `text` to at most `max` UTF-16 code units, marking that it was cut.
-*
-* - A `max` no larger than the marker returns the truncated marker, never a
-*   string longer than `max`.
-* - The cut backs off one unit rather than split a surrogate pair.
-*/
-function truncateReasonText(text, max) {
-	if (max <= 0) return "";
-	if (text.length <= max) return text;
-	if (max <= TRUNCATION_MARKER.length) return TRUNCATION_MARKER.slice(0, max);
-	let cut = max - TRUNCATION_MARKER.length;
-	const last = text.charCodeAt(cut - 1);
-	if (last >= 55296 && last <= 56319) cut -= 1;
-	return text.slice(0, cut) + TRUNCATION_MARKER;
-}
 /** The distinct reasons a round gave, for the error a failed or partial round reports. */
 function distinctReasons(verdicts) {
 	const reasons = /* @__PURE__ */ new Set();
@@ -21002,7 +21006,7 @@ function recordVerdictOutcomes(verdicts) {
 		globalEvalVerdictsTotal.add(1, { outcome });
 	}
 }
-var logger$121, ROUND_JOB_PREFIX, FALLBACK_TARGET, ACCEPTED_DISPATCH_STATUSES, KEY_SEPARATOR, GlobalEvalVerdictOutcome, GlobalEvalRoundResultLabel, GlobalEvalCacheLookupResult, MIN_GLOBAL_EVAL_AGENT_VERSION, WAIT_CEILING_MULTIPLIER, MAX_RAISED_WAIT_CEILING_MS, MIN_WAIT_CEILING_RATIO, MAX_ROUND_REASON_CHARS, TRUNCATION_MARKER, ROUND_MAX_ATTEMPTS;
+var logger$121, ROUND_JOB_PREFIX, FALLBACK_TARGET, ACCEPTED_DISPATCH_STATUSES, KEY_SEPARATOR, GlobalEvalVerdictOutcome, GlobalEvalRoundResultLabel, GlobalEvalCacheLookupResult, MIN_GLOBAL_EVAL_AGENT_VERSION, WAIT_CEILING_MULTIPLIER, MAX_RAISED_WAIT_CEILING_MS, MIN_WAIT_CEILING_RATIO, MAX_ROUND_REASON_CHARS, ROUND_MAX_ATTEMPTS;
 var init_global_eval_round = __esmMin((() => {
 	init_prometheus();
 	init_global_eval_round_cache();
@@ -21039,7 +21043,6 @@ var init_global_eval_round = __esmMin((() => {
 	MAX_RAISED_WAIT_CEILING_MS = ADMITTED_PIPELINE_LIFETIME_MS;
 	MIN_WAIT_CEILING_RATIO = 1.25;
 	MAX_ROUND_REASON_CHARS = 4e3;
-	TRUNCATION_MARKER = "… (truncated)";
 	ROUND_MAX_ATTEMPTS = 2;
 }));
 //#endregion
@@ -47183,7 +47186,8 @@ function createAgentWsHandler(deps) {
 							activeJobs: msg.activeJobs
 						});
 						if (msg.activeJobs === 0) registry.clearBusyHeld(agentId);
-						if (entry.activeJobs < entry.maxConcurrency) await dispatcher.onAgentAvailable(agentId);
+						if (msg.draining === true) registry.markDrainReported(agentId);
+						if (!entry.draining && entry.activeJobs < entry.maxConcurrency) await dispatcher.onAgentAvailable(agentId);
 					}
 					break;
 				}
@@ -63420,6 +63424,35 @@ async function provisionRemoteSource(db, params) {
 }
 var init_remote_source_store = __esmMin((() => {}));
 //#endregion
+//#region src/ws/test-run-log-cursor.ts
+/**
+* The opaque per-file cursor of a `kici run remote` log stream.
+*
+* It records, for each of a run's log files, how many lines the caller already
+* received: `{ "<file>": <lines> }`, JSON-encoded, then base64url so it fits a
+* query string. The file key is the path below `executions/<runId>/`. A file
+* that appears later starts at line 0 wherever it sorts, so no line is lost or
+* sent twice when a step's file sorts before a file that was already read.
+*/
+function encodeRunLogCursor(offsets) {
+	return Buffer.from(JSON.stringify(offsets), "utf8").toString("base64url");
+}
+/** Decode a cursor. The start token decodes to no offsets; malformed input to null. */
+function decodeRunLogCursor(cursor) {
+	if (cursor === TEST_RUN_LOG_CURSOR_START) return {};
+	try {
+		const decoded = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+		const parsed = offsetsSchema.safeParse(decoded);
+		return parsed.success ? parsed.data : null;
+	} catch {
+		return null;
+	}
+}
+var offsetsSchema;
+var init_test_run_log_cursor = __esmMin((() => {
+	offsetsSchema = z.record(z.string(), z.number().int().nonnegative());
+}));
+//#endregion
 //#region src/routes/uploads.ts
 /**
 * Test-run upload provisioning. The developer encrypts the overlay tarball with
@@ -63597,7 +63630,10 @@ async function resolveLockFileForTest(input, deps, runId) {
 function selectMatchedDecisions(input, fullLockFile, simulatedEvent) {
 	let decisions;
 	if (input.workflowName) {
-		if (!fullLockFile.workflows.find((w) => w.name === input.workflowName)) return { rejected: `Workflow '${input.workflowName}' not found in lock file` };
+		if (!fullLockFile.workflows.find((w) => w.name === input.workflowName)) {
+			const available = fullLockFile.workflows.map((w) => w.name).join(", ");
+			return { rejected: `Workflow '${input.workflowName}' not found in lock file. Available workflows: ${available || "(none)"}` };
+		}
 		decisions = [createWorkflowDecision(input.workflowName, true, [], void 0, "Direct test run")];
 	} else decisions = matchAllWorkflows(fullLockFile.workflows, simulatedEvent);
 	const matched = decisions.filter((d) => d.matched);
@@ -64000,11 +64036,18 @@ async function handleTestRunStatus(msg, deps) {
 	};
 }
 /**
-* Return the next chunk of a run's logs from a monotonic line-offset cursor:
-* lines are concatenated in `(jobName ASC, stepIndex ASC, lineIndex ASC)` order
-* and `cursor` counts lines already delivered. `done` is true only when the run
-* is terminal AND the cursor reached the end, so a live or not-yet-drained poll
-* returns what exists with `done: false` and no line is dropped.
+* Return the next chunk of a run's logs.
+*
+* With `logCursor` (the per-file cursor), each log file is read from its own
+* offset, so a file that appears later is read from its first line wherever it
+* sorts. Without it, the stream is the flat `(jobName, stepIndex, lineIndex)`
+* concatenation and `cursor` counts the lines already delivered, which an
+* older CLI sends.
+*
+* `done` is true only once the run is terminal and the stream is delivered to
+* its end. For a terminal run, pending log appends are drained first, because
+* the agent's chunks are persisted fire-and-forget and the status can turn
+* terminal while the last write is still in flight.
 */
 async function handleTestRunLogs(msg, deps) {
 	const run = await deps.db.selectFrom("execution_runs").select([
@@ -64015,6 +64058,11 @@ async function handleTestRunLogs(msg, deps) {
 	if (!run || !run.is_test_run) return { error: "Run not found" };
 	const terminal = TERMINAL_RUN_STATES.has(run.status);
 	if (terminal) await deps.logWriter?.drain(msg.runId);
+	if (msg.logCursor !== void 0) {
+		const offsets = decodeRunLogCursor(msg.logCursor);
+		if (!offsets) return { error: "Invalid log cursor" };
+		return readFromFileOffsets(msg.runId, deps.logStorage, offsets, terminal);
+	}
 	const allLines = await collectRunLogLines(msg.runId, deps.logStorage);
 	const cursor = Math.max(0, msg.cursor);
 	const lines = allLines.slice(cursor);
@@ -64025,26 +64073,55 @@ async function handleTestRunLogs(msg, deps) {
 		done: terminal && nextCursor >= allLines.length
 	};
 }
-/** Reads every step log under `executions/<runId>`; empty with no log storage. */
-async function collectRunLogLines(runId, logStorage) {
-	if (!logStorage) return [];
-	const prefix = `executions/${runId}`;
-	const logFiles = (await logStorage.list(prefix)).map((f) => {
-		const m = f.match(LOG_PATH_RE);
-		return m ? {
-			path: f,
+/** A run's stored log files, ordered by `(jobName, stepIndex)`. */
+async function listRunLogFiles(runId, logStorage) {
+	return (await logStorage.list(`executions/${runId}`)).map((path) => {
+		const m = path.match(LOG_PATH_RE);
+		if (!m) return null;
+		return {
+			key: `job-${m[1]}/step-${m[2]}.log`,
+			path,
 			jobName: m[1],
 			stepIndex: parseInt(m[2], 10)
-		} : null;
+		};
 	}).filter((f) => f !== null).sort((a, b) => a.jobName.localeCompare(b.jobName) || a.stepIndex - b.stepIndex);
+}
+/** A log file's non-empty lines; its unterminated last line only when `withTail`. */
+function splitLogLines(data, withTail) {
+	const parts = data.split("\n");
+	const tail = parts.pop() ?? "";
+	const lines = parts.filter((line) => line.length > 0);
+	if (withTail && tail.length > 0) lines.push(tail);
+	return lines;
+}
+/** Reads every step log under `executions/<runId>`; empty with no log storage. */
+async function collectRunLogLines(runId, logStorage) {
+	if (!logStorage) return [];
 	const lines = [];
-	for (const entry of logFiles) {
-		const result = await logStorage.read(entry.path);
-		for (const line of result.data.split("\n")) if (line.length > 0) lines.push(line);
-	}
+	for (const file of await listRunLogFiles(runId, logStorage)) lines.push(...splitLogLines((await logStorage.read(file.path)).data, true));
 	return lines;
 }
 /**
+* Read each log file from its own offset. A live file's last line can still
+* be mid-write, so it is read once it ends, or once the run is terminal.
+*/
+async function readFromFileOffsets(runId, logStorage, offsets, terminal) {
+	const next = { ...offsets };
+	const lines = [];
+	if (logStorage) for (const file of await listRunLogFiles(runId, logStorage)) {
+		const fileLines = splitLogLines((await logStorage.read(file.path)).data, terminal);
+		const from = Math.min(offsets[file.key] ?? 0, fileLines.length);
+		lines.push(...fileLines.slice(from));
+		next[file.key] = Math.max(offsets[file.key] ?? 0, fileLines.length);
+	}
+	return {
+		lines,
+		nextCursor: Object.values(next).reduce((sum, n) => sum + n, 0),
+		done: terminal,
+		nextLogCursor: encodeRunLogCursor(next)
+	};
+}
+/**
 * Cancel a running test run: signal cancellation to every dispatched agent,
 * mark still-pending dispatch queue entries `expired`, and mark the
 * `execution_runs` row cancelled. Returns `{ cancelled }` — true when the run
@@ -64098,6 +64175,7 @@ async function handleTestCancel(msg, deps) {
 var logger$59, LOG_PATH_RE;
 var init_test_relay_handlers = __esmMin((() => {
 	init_job_queue();
+	init_test_run_log_cursor();
 	init_uploads();
 	init_test_pipeline();
 	init_run_detached();
@@ -64359,7 +64437,8 @@ function createTestDirectRoutes(deps) {
 	app.get("/api/v1/test/runs/:runId/logs", (c) => runRoute(c, deps, "test_run.read", (msg, d) => handleTestRunLogs({
 		type: "test.relay.run.logs",
 		...msg,
-		cursor: parseCursor$1(c.req.query("cursor"))
+		cursor: parseCursor$1(c.req.query("cursor")),
+		logCursor: c.req.query("logCursor")
 	}, d)));
 	app.post("/api/v1/test/runs/:runId/cancel", (c) => runRoute(c, deps, "test_run.trigger", (msg, d) => handleTestCancel({
 		type: "test.relay.cancel",
@@ -68447,14 +68526,14 @@ function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => {
 			return {
-				version: "0.18.0",
-				buildDate: "2026-10-15T15:45:04.733Z",
-				sdkVersion: "0.18.0",
+				version: "0.20.0",
+				buildDate: "2026-10-17T08:12:16.425Z",
+				sdkVersion: "0.20.0",
 				sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-				sharedVersion: "0.18.0",
+				sharedVersion: "0.20.0",
 				sharedBundleHash: "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b",
-				engineVersion: "0.18.0",
-				engineBundleHash: "193df1e8eb0be8e65c2d0e30e4eab0f7d6379cf0e3975fe3a9be800f2b91f9a9"
+				engineVersion: "0.20.0",
+				engineBundleHash: "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd"
 			};
 		},
 		readinessCheck: deps.db ? async () => {
@@ -68486,7 +68565,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.18.0",
+			orchestratorVersion: "0.20.0",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -71720,7 +71799,7 @@ var init_app = __esmMin((() => {
 	init_agent_metrics_aggregator();
 	init_run_detached();
 	logger$38 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.18.0";
+	ORCHESTRATOR_VERSION$2 = "0.20.0";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -72256,6 +72335,7 @@ function buildAgentContainerHostConfig(input) {
 		...typeof cpus === "number" && cpus > 0 ? { NanoCpus: Math.round(cpus * 1e9) } : {},
 		...input.binds && input.binds.length > 0 ? { Binds: input.binds } : {},
 		...input.extraHosts && input.extraHosts.length > 0 ? { ExtraHosts: input.extraHosts } : {},
+		...input.supplementaryGroups && input.supplementaryGroups.length > 0 ? { GroupAdd: input.supplementaryGroups.map(String) } : {},
 		AutoRemove: false,
 		PidsLimit: AGENT_CONTAINER_PIDS_LIMIT
 	};
@@ -72582,6 +72662,19 @@ async function detectRuntime(runtimeHint) {
 * Create a LogCapture from a running container's stdout/stderr streams.
 * Uses dockerode's demuxStream to strip Docker's 8-byte multiplexed headers.
 */
+/**
+* The cpu / memory ceiling for one spawn. `effectiveLimits` from ScalerManager
+* wins: it already folds in job overrides, label-set and scaler defaults.
+* Otherwise the label set's (or the scaler's default) `resources.limits` apply.
+*/
+function resolveSpawnLimits(effectiveLimits, resources) {
+	if (effectiveLimits && (effectiveLimits.cpus || effectiveLimits.memBytes)) return effectiveLimits;
+	const limits = resources?.limits;
+	return {
+		...limits?.memory ? { memBytes: parseMemoryString(limits.memory) } : {},
+		...limits?.cpus ? { cpus: limits.cpus } : {}
+	};
+}
 async function createContainerLogCapture(docker, containerId) {
 	const stream = await docker.getContainer(containerId).logs({
 		follow: true,
@@ -72898,15 +72991,7 @@ var init_container_backend = __esmMin((() => {
 				];
 				const binds = [...matchedLabelSet.volumes ?? []];
 				if (matchedLabelSet.containerSocket && this.resolvedSocketPath) binds.push(`${this.resolvedSocketPath}:${this.resolvedSocketPath}`);
-				let resolvedLimits;
-				if (effectiveLimits && (effectiveLimits.cpus || effectiveLimits.memBytes)) resolvedLimits = effectiveLimits;
-				else {
-					const limits = (matchedLabelSet.resources ?? this.defaultResources)?.limits;
-					resolvedLimits = {
-						...limits?.memory ? { memBytes: parseMemoryString(limits.memory) } : {},
-						...limits?.cpus ? { cpus: limits.cpus } : {}
-					};
-				}
+				const resolvedLimits = resolveSpawnLimits(effectiveLimits, matchedLabelSet.resources ?? this.defaultResources);
 				const jobContainer = spawnContext?.container;
 				const spawnImage = jobContainer?.image ?? matchedLabelSet.image;
 				await pullImageIfMissing({
@@ -72929,6 +73014,7 @@ var init_container_backend = __esmMin((() => {
 					binds.push(runtimeInjectBind(runtimeVolume));
 					agentInit = runtimeInitCommand(await agentImageLabels(this.docker, matchedLabelSet.image));
 				}
+				if (!jobContainer) env.push("KICI_SCALER_SINGLE_JOB=1");
 				emit(ScalerEventType$1.enum["scaler.provisioning"], "creating container");
 				const normalizedLabelSetStr = normalizeLabelSet(labelSet);
 				const container = await this.docker.createContainer({
@@ -72947,7 +73033,8 @@ var init_container_backend = __esmMin((() => {
 					HostConfig: buildAgentContainerHostConfig({
 						limits: resolvedLimits,
 						binds,
-						...this.extraHosts ? { extraHosts: this.extraHosts } : {}
+						...this.extraHosts ? { extraHosts: this.extraHosts } : {},
+						...!jobContainer && { supplementaryGroups: [1990] }
 					}),
 					...this.networkIsolation && { NetworkingConfig: { EndpointsConfig: { ["kici-agent-net"]: {} } } }
 				});
@@ -91327,13 +91414,13 @@ var init_worker_core = __esmMin((() => {
 	init_app_on_error();
 	init_run_detached();
 	init_peer_job_cancel();
-	ORCHESTRATOR_VERSION$1 = "0.18.0";
-	WORKER_SDK_VERSION = "0.18.0";
+	ORCHESTRATOR_VERSION$1 = "0.20.0";
+	WORKER_SDK_VERSION = "0.20.0";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.18.0";
+	WORKER_SHARED_VERSION = "0.20.0";
 	WORKER_SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-	WORKER_ENGINE_VERSION = "0.18.0";
-	WORKER_ENGINE_BUNDLE_HASH = "193df1e8eb0be8e65c2d0e30e4eab0f7d6379cf0e3975fe3a9be800f2b91f9a9";
+	WORKER_ENGINE_VERSION = "0.20.0";
+	WORKER_ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
 }));
@@ -91362,13 +91449,13 @@ init_webhook_url_resolvers();
 init_run_detached();
 init_peer_job_cancel();
 init_orphan_requests();
-const ORCHESTRATOR_VERSION = "0.18.0";
-const SDK_VERSION = "0.18.0";
+const ORCHESTRATOR_VERSION = "0.20.0";
+const SDK_VERSION = "0.20.0";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.18.0";
+const SHARED_VERSION = "0.20.0";
 const SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-const ENGINE_VERSION = "0.18.0";
-const ENGINE_BUNDLE_HASH = "193df1e8eb0be8e65c2d0e30e4eab0f7d6379cf0e3975fe3a9be800f2b91f9a9";
+const ENGINE_VERSION = "0.20.0";
+const ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT