@kici-dev/orchestrator 0.2.0 → 0.4.0

package/dist/server.js

@@ -1,6 +1,6 @@
 import "node:module";
 import { AgentDeliveryMode, AgentPlatform, BaseColdStore, ChunkRequestWaiter, RingBuffer, addLogsToArchive, chunkBuffer, computeBackoffDelay, computeMigrationsHash, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, decrypt, decryptJson, deriveKey, encodeKeySegment, encrypt, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, isPgUniqueViolation, logger, parseDatabaseUrl, redactConfig, requestContext, serializeError, setServiceName, setupGracefulShutdown, sha256, storeMigrationContentHash, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
-import { ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, HeldRunQueueType, HoldScope, HoldType, INIT_LABEL, InitFailureCategory, InventorySelectorSchema, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MIN_PROTOCOL_VERSION, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchRole, OrchestratorMode, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, RELAY_INGRESS_MODES, RegisterableTriggerType, RunFailureClass, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, SourceOrigin, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidScopeName, attestationVerifyStatusSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, canonicalizeCapability, checkArtifactName, coerceDispatchInputs, collectDiscriminatorTypes, createWorkflowDecision, dashboardArtifactsListResponseSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListResponseSchema, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, derivePlatformTaints, fanoutEnvelopeFields, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, githubIngressPath, githubWebhookPath, hasPlatformCapability, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, installGateJobId, isFailureStatus, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, normalizePersistedHoldType, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, persistedHoldTypeSpellings, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, stateReplaySchema, stringifyActor, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName, wrapUntrusted } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, HeldRunQueueType, HoldScope, HoldType, INIT_LABEL, InitFailureCategory, InventorySelectorSchema, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MIN_PROTOCOL_VERSION, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchRole, OrchestratorMode, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, RELAY_INGRESS_MODES, RegisterableTriggerType, RunFailureClass, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, SourceOrigin, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidScopeName, assertValidSecretKey, attestationVerifyStatusSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, canonicalizeCapability, checkArtifactName, coerceDispatchInputs, collectDiscriminatorTypes, createWorkflowDecision, dashboardArtifactsListResponseSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListResponseSchema, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, derivePlatformTaints, fanoutEnvelopeFields, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, githubIngressPath, githubWebhookPath, hasPlatformCapability, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, installGateJobId, isFailureStatus, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, normalizePersistedHoldType, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, persistedHoldTypeSpellings, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, stateReplaySchema, stringifyActor, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName, validateSecretKey, wrapUntrusted } from "@kici-dev/engine";
 import { X509Certificate, createCipheriv, createDecipheriv, createHash, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs$1 from "node:fs";
 import { chmodSync, closeSync, createReadStream, createWriteStream, fsyncSync, mkdirSync, mkdtempSync, openSync, promises, readFileSync, renameSync, rmSync, statSync, unwatchFile, watchFile, writeFileSync, writeSync } from "node:fs";
@@ -162,7 +162,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 	const force = options.force ?? false;
 	const runRow = await db.selectFrom("execution_runs").select(["status"]).where("run_id", "=", runId).executeTakeFirst();
 	if (runRow && TERMINAL_RUN_STATES.has(runRow.status)) {
-		logger$129.info("Cancel ignored: run already terminal", {
+		logger$131.info("Cancel ignored: run already terminal", {
 			runId,
 			status: runRow.status
 		});
@@ -190,7 +190,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 			}));
 			agentsNotified++;
 		} catch (err) {
-			logger$129.warn("Failed to send job.cancel to agent; treating job as orphaned", {
+			logger$131.warn("Failed to send job.cancel to agent; treating job as orphaned", {
 				runId,
 				jobId,
 				agentId,
@@ -201,7 +201,8 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 	const pendingResult = await db.updateTable("execution_jobs").set({
 		status: ExecutionJobStatus.enum.cancelled,
 		completed_at: /* @__PURE__ */ new Date(),
-		error_message: reason
+		error_message: reason,
+		routing_reason: null
 	}).where("run_id", "=", runId).where("status", "in", [ExecutionJobStatus.enum.pending, ExecutionJobStatus.enum.queued]).execute();
 	const pendingCancelled = Number(pendingResult[0]?.numUpdatedRows ?? 0);
 	await jobQueue.cancelByRunId(runId);
@@ -220,7 +221,7 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 		orphansCancelled = Number(orphanResult[0]?.numUpdatedRows ?? 0);
 		await executionTracker.completeRunIfAllJobsTerminal(runId);
 	}
-	logger$129.info("Cancelled run", {
+	logger$131.info("Cancelled run", {
 		runId,
 		agentsNotified,
 		pendingCancelled,
@@ -233,9 +234,9 @@ async function cancelRunWithReason(deps, runId, reason, options = {}) {
 		alreadyTerminal: false
 	};
 }
-var logger$129;
+var logger$131;
 var init_cancel_run = __esmMin((() => {
-	logger$129 = createLogger({ prefix: "cancel-run" });
+	logger$131 = createLogger({ prefix: "cancel-run" });
 }));
 //#endregion
 //#region src/cancel/dashboard-cancel-handler.ts
@@ -491,7 +492,7 @@ function readDeploymentIdentity(env = process.env, execPath = process.execPath,
 * `test.relay.uploads.init` relay handler — the developer never reaches the
 * orchestrator's HTTP API directly.
 */
-const logger$128 = createLogger({ prefix: "uploads" });
+const logger$130 = createLogger({ prefix: "uploads" });
 /**
 * Sanitize a routing key for use in S3 storage paths.
 * Replaces characters that are problematic in S3 keys.
@@ -533,7 +534,7 @@ async function initTestUpload(deps, params) {
 		expires_at: expiresAt,
 		created_by: params.createdBy ?? null
 	}).execute();
-	logger$128.info("Upload initialized", {
+	logger$130.info("Upload initialized", {
 		uploadId,
 		routingKey,
 		sha: sha ?? "unknown",
@@ -1092,6 +1093,7 @@ var prometheus_exports = /* @__PURE__ */ __exportAll({
 	trustMatchRefusedNoIdTotal: () => trustMatchRefusedNoIdTotal,
 	trustPolicyDecisionsTotal: () => trustPolicyDecisionsTotal,
 	universalGitRegistrationErrorsTotal: () => universalGitRegistrationErrorsTotal,
+	unroutableFastFailedTotal: () => unroutableFastFailedTotal,
 	webhooksProcessedTotal: () => webhooksProcessedTotal,
 	webhooksReceivedTotal: () => webhooksReceivedTotal,
 	wsNackReceivedTotal: () => wsNackReceivedTotal,
@@ -1276,7 +1278,7 @@ function registerOrchestratorMetrics() {
 	_observableGaugesRegistered = true;
 	for (const register of _observableGauges) register();
 }
-var _meter$1, _observableGauges, _agentsActiveValue, _configVersionValue, _drainingValue, _declaredHostsUnreachableValue, _staleRunsCurrentValue, _pendingAttestationsValue, _pendingAttestationOldestAgeSeconds, _rejectedAttestationsValue, _dbCollationDrift, _scalerUsageRows, _scalerSpawnRefusalsValue, scalerRedispatchTotal, _queueDepthBreakdown, _everSeenQueueLabels, EMPTY_INGEST_STATE, _ingest, _ingestLimits, ingestShedTotal, stateReplayBreakerTripsTotal, ingestAdmittedTotal, _overflowBuffered, ingestOverflowCapturedTotal, ingestOverflowReplayedTotal, ingestOverflowDroppedTotal, webhooksReceivedTotal, webhooksProcessedTotal, trustPolicyDecisionsTotal, triggerMatchDurationSeconds, dedupHitsTotal, pgPoolClientErrorsTotal, sourceCacheHitsTotal, sourceCacheMissesTotal, depCacheHitsTotal, depCacheMissesTotal, buildDurationSeconds, executionsTotal, executionDurationSeconds, stepsTotal, githubCheckRunTotal, logChunksReceivedTotal, logBytesStoredTotal, scalerConfigReloadsTotal, ScalerSpawnFailureBound, scalerSpawnFailuresTotal, configReloadTotal, staleRunsDetectedTotal, staleDetectionDurationSeconds, crossSourceFanoutSize, crossSourceErrorsTotal, universalGitRegistrationErrorsTotal, trustMatchRefusedNoIdTotal, eventDispatchSuccessTotal, eventRetryTotal, eventDlqTotal, eventLeaseExpirationsTotal, eventAttemptsHistogram, _eventDlqDepthValue, InstallSecretsDecisionReason, InstallSecretsChannel, installSecretsDecisionsTotal, installSecretsRegistryUsedTotal, installSecretsContributorStrippedTotal, installSecretsTokenResolutionDurationSeconds, dispatchQueueRowsPrunedTotal, stepLogsPrunedTotal, checkRunTrackingRowsPrunedTotal, wsUnsupportedMessageSentTotal, wsNackReceivedTotal, wsPlatformCapabilityGapTotal, _observableGaugesRegistered;
+var _meter$1, _observableGauges, _agentsActiveValue, _configVersionValue, _drainingValue, _declaredHostsUnreachableValue, _staleRunsCurrentValue, _pendingAttestationsValue, _pendingAttestationOldestAgeSeconds, _rejectedAttestationsValue, _dbCollationDrift, _scalerUsageRows, _scalerSpawnRefusalsValue, scalerRedispatchTotal, _queueDepthBreakdown, _everSeenQueueLabels, EMPTY_INGEST_STATE, _ingest, _ingestLimits, ingestShedTotal, stateReplayBreakerTripsTotal, ingestAdmittedTotal, _overflowBuffered, ingestOverflowCapturedTotal, ingestOverflowReplayedTotal, ingestOverflowDroppedTotal, webhooksReceivedTotal, webhooksProcessedTotal, trustPolicyDecisionsTotal, triggerMatchDurationSeconds, dedupHitsTotal, pgPoolClientErrorsTotal, sourceCacheHitsTotal, sourceCacheMissesTotal, depCacheHitsTotal, depCacheMissesTotal, buildDurationSeconds, executionsTotal, executionDurationSeconds, stepsTotal, githubCheckRunTotal, logChunksReceivedTotal, logBytesStoredTotal, scalerConfigReloadsTotal, ScalerSpawnFailureBound, scalerSpawnFailuresTotal, configReloadTotal, staleRunsDetectedTotal, staleDetectionDurationSeconds, crossSourceFanoutSize, crossSourceErrorsTotal, universalGitRegistrationErrorsTotal, trustMatchRefusedNoIdTotal, eventDispatchSuccessTotal, eventRetryTotal, eventDlqTotal, eventLeaseExpirationsTotal, eventAttemptsHistogram, _eventDlqDepthValue, InstallSecretsDecisionReason, InstallSecretsChannel, installSecretsDecisionsTotal, installSecretsRegistryUsedTotal, installSecretsContributorStrippedTotal, installSecretsTokenResolutionDurationSeconds, dispatchQueueRowsPrunedTotal, unroutableFastFailedTotal, stepLogsPrunedTotal, checkRunTrackingRowsPrunedTotal, wsUnsupportedMessageSentTotal, wsNackReceivedTotal, wsPlatformCapabilityGapTotal, _observableGaugesRegistered;
 var init_prometheus = __esmMin((() => {
 	_observableGauges = [];
 	_agentsActiveValue = 0;
@@ -1533,6 +1535,7 @@ var init_prometheus = __esmMin((() => {
 		] }
 	});
 	dispatchQueueRowsPrunedTotal = lazyCounter$1("kici_orch_dispatch_queue_rows_pruned_total", { description: "Terminal dispatch_queue rows deleted by the retention sweep" });
+	unroutableFastFailedTotal = lazyCounter$1("kici_orch_unroutable_fast_failed_total", { description: "Jobs terminalized as unroutable by the fast-fail probe (not the queue timeout)" });
 	stepLogsPrunedTotal = lazyCounter$1("kici_orch_step_logs_pruned_total", { description: "Step-log objects deleted by the retention sweep" });
 	checkRunTrackingRowsPrunedTotal = lazyCounter$1("kici_orch_check_run_tracking_rows_pruned_total", { description: "check_run_tracking rows deleted by the retention sweep" });
 	wsUnsupportedMessageSentTotal = lazyCounter$1("kici_orch_ws_unsupported_message_sent_total", { description: "NACKs sent to the Platform for an unrecognized inbound message type (version skew)" });
@@ -1565,7 +1568,7 @@ var trust_resolver_exports = /* @__PURE__ */ __exportAll({
 function findIdentityLink(identityLinks, provider, providerUsername, providerUserId) {
 	if (providerUserId === void 0 || providerUserId.length === 0) {
 		trustMatchRefusedNoIdTotal.add(1, { reason: "event_missing" });
-		logger$127.warn("Trust match refused: webhook event has no provider numeric id", {
+		logger$129.warn("Trust match refused: webhook event has no provider numeric id", {
 			provider,
 			providerUsername
 		});
@@ -1577,7 +1580,7 @@ function findIdentityLink(identityLinks, provider, providerUsername, providerUse
 	if (byUsername) {
 		const reason = byUsername.providerUserId === null || byUsername.providerUserId === void 0 ? "link_missing" : "id_mismatch";
 		trustMatchRefusedNoIdTotal.add(1, { reason });
-		logger$127.warn("Trust match refused: numeric id missing on link or did not match event", {
+		logger$129.warn("Trust match refused: numeric id missing on link or did not match event", {
 			provider,
 			providerUsername,
 			providerUserId,
@@ -1605,10 +1608,10 @@ function isReadOrHigher(permission) {
 function isCiTrustWriteOrHigher(level) {
 	return level === "write" || level === "admin";
 }
-var logger$127, TrustResolver$1;
+var logger$129, TrustResolver$1;
 var init_trust_resolver = __esmMin((() => {
 	init_prometheus();
-	logger$127 = createLogger({ prefix: "trust-resolver" });
+	logger$129 = createLogger({ prefix: "trust-resolver" });
 	TrustResolver$1 = class {
 		contributorCache;
 		constructor(contributorCache) {
@@ -1739,14 +1742,14 @@ async function handleApprovalComment(params) {
 	const { commentBody, commenterUsername, commenterUserId, provider, repoIdentifier, prNumber, orgId, identityLinks, orgMemberPermissions, heldRunStore } = params;
 	const command = parseKiciCommand(commentBody);
 	if (!command) return { handled: false };
-	logger$126.info("Processing /kici command", {
+	logger$128.info("Processing /kici command", {
 		action: command.action,
 		commenter: commenterUsername,
 		runId: command.runId
 	});
 	const identityLink = findIdentityLink(identityLinks, provider, commenterUsername, commenterUserId);
 	if (!identityLink) {
-		logger$126.info("No identity link for commenter", {
+		logger$128.info("No identity link for commenter", {
 			commenter: commenterUsername,
 			provider
 		});
@@ -1757,7 +1760,7 @@ async function handleApprovalComment(params) {
 	}
 	const ciTrustLevel = orgMemberPermissions.get(identityLink.userId) ?? "none";
 	if (ciTrustLevel !== "write" && ciTrustLevel !== "admin") {
-		logger$126.info("Insufficient ci_trust level", {
+		logger$128.info("Insufficient ci_trust level", {
 			commenter: commenterUsername,
 			userId: identityLink.userId,
 			ciTrustLevel
@@ -1769,7 +1772,7 @@ async function handleApprovalComment(params) {
 	}
 	const pendingHolds = await heldRunStore.listPendingSecurityHoldsForPr(orgId, repoIdentifier, prNumber);
 	if (pendingHolds.length === 0) {
-		logger$126.info("No pending security holds found for PR", {
+		logger$128.info("No pending security holds found for PR", {
 			orgId,
 			repoIdentifier,
 			prNumber
@@ -1778,7 +1781,7 @@ async function handleApprovalComment(params) {
 	}
 	const targetHolds = command.runId ? pendingHolds.filter((h) => h.run_id === command.runId) : pendingHolds;
 	if (targetHolds.length === 0) {
-		logger$126.info("No matching security holds found", {
+		logger$128.info("No matching security holds found", {
 			orgId,
 			runId: command.runId
 		});
@@ -1789,14 +1792,14 @@ async function handleApprovalComment(params) {
 	for (const hold of targetHolds) try {
 		if (approved) {
 			await heldRunStore.approveByQueueType(orgId, hold.id, identityLink.userId, "security");
-			logger$126.info("Security hold approved", {
+			logger$128.info("Security hold approved", {
 				heldRunId: hold.id,
 				runId: hold.run_id,
 				approvedBy: identityLink.userId
 			});
 		} else {
 			await heldRunStore.reject(orgId, hold.id, `Rejected by ${commenterUsername} via /kici reject`);
-			logger$126.info("Security hold rejected", {
+			logger$128.info("Security hold rejected", {
 				heldRunId: hold.id,
 				runId: hold.run_id,
 				rejectedBy: commenterUsername
@@ -1804,7 +1807,7 @@ async function handleApprovalComment(params) {
 		}
 		processedCount++;
 	} catch (err) {
-		logger$126.error("Failed to process security hold", {
+		logger$128.error("Failed to process security hold", {
 			heldRunId: hold.id,
 			action: command.action,
 			error: toErrorMessage(err)
@@ -1814,15 +1817,15 @@ async function handleApprovalComment(params) {
 		const title = approved ? "Approved" : "Rejected";
 		const summary = approved ? `Approved by ${commenterUsername} via /kici approve` : `Rejected by ${commenterUsername} via /kici reject`;
 		params.checkStatusPoster.postCheckStatus(params.repoIdentifier, params.commitSha, approved ? "success" : "failure", title, summary, params.credentials).catch((err) => {
-			logger$126.warn("Failed to update check status after approval", { error: toErrorMessage(err) });
+			logger$128.warn("Failed to update check status after approval", { error: toErrorMessage(err) });
 		});
 	}
 	return { handled: true };
 }
-var logger$126;
+var logger$128;
 var init_comment_handler = __esmMin((() => {
 	init_trust_resolver();
-	logger$126 = createLogger({ prefix: "comment-handler" });
+	logger$128 = createLogger({ prefix: "comment-handler" });
 }));
 //#endregion
 //#region src/registration/extractor.ts
@@ -1916,9 +1919,9 @@ function payloadFromObject$1(payload) {
 function payloadFromRawBody(body) {
 	return { raw: Buffer.from(body, "utf-8") };
 }
-var logger$125, EventLogWriter;
+var logger$127, EventLogWriter;
 var init_event_log$1 = __esmMin((() => {
-	logger$125 = createLogger({ prefix: "event-log" });
+	logger$127 = createLogger({ prefix: "event-log" });
 	EventLogWriter = class EventLogWriter {
 		db;
 		logStorage;
@@ -1955,7 +1958,7 @@ var init_event_log$1 = __esmMin((() => {
 			if (sizeBytes > maxBytes) {
 				payloadOmitted = true;
 				payloadOmittedReason = PayloadOmittedReason.enum.size_exceeded;
-				logger$125.warn("Webhook payload exceeds soft cap; recording metadata only", {
+				logger$127.warn("Webhook payload exceeds soft cap; recording metadata only", {
 					deliveryId: info.deliveryId,
 					sizeBytes,
 					maxBytes
@@ -1969,7 +1972,7 @@ var init_event_log$1 = __esmMin((() => {
 				} catch (err) {
 					payloadOmitted = true;
 					payloadOmittedReason = PayloadOmittedReason.enum.storage_failed;
-					logger$125.error("Failed to upload event-log payload to object storage", {
+					logger$127.error("Failed to upload event-log payload to object storage", {
 						deliveryId: info.deliveryId,
 						orgId: outcome.orgId,
 						error: toErrorMessage(err)
@@ -2006,7 +2009,7 @@ var init_event_log$1 = __esmMin((() => {
 					ref: row.ref
 				})).execute();
 			} catch (err) {
-				logger$125.error("Failed to record event_log row", {
+				logger$127.error("Failed to record event_log row", {
 					deliveryId: info.deliveryId,
 					orgId: outcome.orgId,
 					error: toErrorMessage(err)
@@ -2764,6 +2767,7 @@ var init_schema = __esmMin((() => {
 		rosterTtlMs: z.coerce.number().default(18e5),
 		queueMaxDepth: z.coerce.number().default(1e3),
 		queueTimeoutMs: z.coerce.number().default(36e5),
+		unroutableGraceMs: z.coerce.number().default(12e4),
 		/**
 		* Operator-facing backpressure warning threshold. See `configSchema` in
 		* `packages/orchestrator/src/config.ts` for the user-facing prose.
@@ -3243,6 +3247,7 @@ function flattenToAppConfig(merged) {
 	const queue = merged.queue;
 	flat.queueMaxDepth = queue?.maxDepth ?? 1e3;
 	flat.queueTimeoutMs = queue?.timeoutMs ?? 36e5;
+	flat.unroutableGraceMs = queue?.unroutableGraceMs ?? 12e4;
 	flat.queueBackpressureThreshold = queue?.backpressureThreshold ?? 100;
 	const lfCache = merged.lockfileCache;
 	flat.lockfileCacheMax = lfCache?.max ?? 500;
@@ -3334,9 +3339,9 @@ function satisfiesMandatoryLabels(agent, requiredLabels) {
 	for (const label of agent.mandatoryLabels) if (!requiredSet.has(label)) return false;
 	return true;
 }
-var logger$124, AgentRegistry;
+var logger$126, AgentRegistry;
 var init_registry = __esmMin((() => {
-	logger$124 = createLogger({ prefix: "agent-registry" });
+	logger$126 = createLogger({ prefix: "agent-registry" });
 	AgentRegistry = class {
 		/** Primary: agentId -> AgentEntry */
 		agents = /* @__PURE__ */ new Map();
@@ -3459,7 +3464,7 @@ var init_registry = __esmMin((() => {
 					arch,
 					instanceId,
 					properties: metadata?.properties
-				}).catch((err) => logger$124.warn("host_roster upsert failed (best-effort)", {
+				}).catch((err) => logger$126.warn("host_roster upsert failed (best-effort)", {
 					agentId,
 					error: toErrorMessage(err)
 				}));
@@ -3854,9 +3859,9 @@ var init_leader_gated_scheduler = __esmMin((() => {
 * Driven by the leader-only host-roster reaper's tick (one timer, one leader),
 * so this class owns no timer of its own — just a testable `scan()`.
 */
-var logger$123, RebootDeadlineSweep;
+var logger$125, RebootDeadlineSweep;
 var init_reboot_deadline_sweep = __esmMin((() => {
-	logger$123 = createLogger({ prefix: "reboot-deadline-sweep" });
+	logger$125 = createLogger({ prefix: "reboot-deadline-sweep" });
 	RebootDeadlineSweep = class {
 		rosterStore;
 		constructor(deps) {
@@ -3868,21 +3873,21 @@ var init_reboot_deadline_sweep = __esmMin((() => {
 				const expired = await this.rosterStore.listExpiredRebootPending(Date.now());
 				for (const agentId of expired) {
 					await this.rosterStore.clearRebootPending(agentId);
-					logger$123.warn("Host did not return after reboot within deadline; cleared reboot-pending", { agentId });
+					logger$125.warn("Host did not return after reboot within deadline; cleared reboot-pending", { agentId });
 				}
 			} catch (err) {
-				logger$123.error("Reboot deadline sweep error", { error: toErrorMessage(err) });
+				logger$125.error("Reboot deadline sweep error", { error: toErrorMessage(err) });
 			}
 		}
 	};
 }));
 //#endregion
 //#region src/agent/host-roster-reaper.ts
-var logger$122, HostRosterReaper;
+var logger$124, HostRosterReaper;
 var init_host_roster_reaper = __esmMin((() => {
 	init_leader_gated_scheduler();
 	init_reboot_deadline_sweep();
-	logger$122 = createLogger({ prefix: "host-roster-reaper" });
+	logger$124 = createLogger({ prefix: "host-roster-reaper" });
 	HostRosterReaper = class {
 		store;
 		ttlMs;
@@ -3901,7 +3906,7 @@ var init_host_roster_reaper = __esmMin((() => {
 			this.scheduler = new LeaderGatedScheduler({
 				name: "host roster reaper",
 				intervalMs: this.scanIntervalMs,
-				logger: logger$122,
+				logger: logger$124,
 				tick: () => this.tick()
 			});
 		}
@@ -3918,10 +3923,10 @@ var init_host_roster_reaper = __esmMin((() => {
 		async tick() {
 			if (!this.scheduler.isLeader) return;
 			const deleted = await this.store.reapEphemeralPastTtl(this.ttlMs);
-			if (deleted > 0) logger$122.info("Reaped expired ephemeral hosts", { deleted });
+			if (deleted > 0) logger$124.info("Reaped expired ephemeral hosts", { deleted });
 			const unreachable = await this.store.countStaticUnreachable(this.graceMs);
 			this.setUnreachableGauge(unreachable);
-			if (unreachable > 0) logger$122.warn("Declared hosts unreachable", { count: unreachable });
+			if (unreachable > 0) logger$124.warn("Declared hosts unreachable", { count: unreachable });
 			await this.rebootSweep.scan();
 		}
 	};
@@ -3929,6 +3934,22 @@ var init_host_roster_reaper = __esmMin((() => {
 //#endregion
 //#region src/queue/job-queue.ts
 /**
+* Shared row -> {@link ExpiredJobInfo} mapping, so the expiry sweep and the
+* unroutable probe can never read a job's selectors differently.
+*/
+function rowToExpiredJobInfo(r) {
+	return {
+		id: r.id,
+		runId: r.run_id,
+		jobName: r.job_name,
+		lastProvisioningError: r.last_provisioning_error ?? null,
+		runsOnLabels: parseSelectorColumnForExpiry(r.runs_on_labels, "runs_on_labels"),
+		runsOnPatterns: parseSelectorColumnForExpiry(r.runs_on_patterns, "runs_on_patterns"),
+		excludeLabels: parseSelectorColumnForExpiry(r.exclude_labels, "exclude_labels"),
+		excludePatterns: parseSelectorColumnForExpiry(r.exclude_patterns, "exclude_patterns")
+	};
+}
+/**
 * Parse a `dispatch_queue` jsonb pattern column into a `LabelMatcher[]`. Handles
 * both the auto-parsed array form (from the pg driver) and the JSON string form
 * (from tests / a non-parsing driver). A missing value yields `[]`.
@@ -3959,9 +3980,9 @@ function parseSelectorColumnForExpiry(v, column) {
 	if (typeof v === "string") try {
 		const parsed = JSON.parse(v);
 		if (Array.isArray(parsed)) return parsed;
-		logger$121.warn("dispatch_queue selector column is not a JSON array", { column });
+		logger$123.warn("dispatch_queue selector column is not a JSON array", { column });
 	} catch {
-		logger$121.warn("dispatch_queue selector column holds malformed JSON", { column });
+		logger$123.warn("dispatch_queue selector column holds malformed JSON", { column });
 	}
 	return [];
 }
@@ -3976,9 +3997,9 @@ function jobPatternsSatisfiedBy(job, labels) {
 	if (job.excludePatterns.some((p) => matcherSatisfiedBy(p, labels))) return false;
 	return true;
 }
-var logger$121, JobQueue;
+var logger$123, JobQueue;
 var init_job_queue = __esmMin((() => {
-	logger$121 = createLogger({ prefix: "job-queue" });
+	logger$123 = createLogger({ prefix: "job-queue" });
 	JobQueue = class {
 		db;
 		/** Cluster-wide fallback for queue_max_depth when cluster_settings is null. */
@@ -4287,16 +4308,7 @@ var init_job_queue = __esmMin((() => {
 			]).where("status", "=", "pending").where("expires_at", "is not", null).where("expires_at", "<", now).execute();
 			if (rows.length === 0) return [];
 			await this.db.updateTable("dispatch_queue").set({ status: "expired" }).where("id", "in", rows.map((r) => r.id)).execute();
-			return rows.map((r) => ({
-				id: r.id,
-				runId: r.run_id,
-				jobName: r.job_name,
-				lastProvisioningError: r.last_provisioning_error ?? null,
-				runsOnLabels: parseSelectorColumnForExpiry(r.runs_on_labels, "runs_on_labels"),
-				runsOnPatterns: parseSelectorColumnForExpiry(r.runs_on_patterns, "runs_on_patterns"),
-				excludeLabels: parseSelectorColumnForExpiry(r.exclude_labels, "exclude_labels"),
-				excludePatterns: parseSelectorColumnForExpiry(r.exclude_patterns, "exclude_patterns")
-			}));
+			return rows.map((r) => rowToExpiredJobInfo(r));
 		}
 		/**
 		* Bulk-fail every still-non-terminal dispatch_queue entry for a run.
@@ -4571,7 +4583,8 @@ var init_job_queue = __esmMin((() => {
 				dispatch_attempts: sql`dispatch_attempts + 1`,
 				ack_deadline: null,
 				ack_agent_id: null,
-				agent_id: null
+				agent_id: null,
+				unroutable_since: null
 			}).where("id", "=", jobId).where("status", "=", "dispatched").returning("dispatch_attempts").executeTakeFirst();
 			this.depthCache = null;
 			this.breakdownCache = null;
@@ -4694,6 +4707,59 @@ var init_job_queue = __esmMin((() => {
 			return (await this.pendingOldestFirstQuery().limit(limit).execute()).map((row) => this.rowToQueuedJob(row));
 		}
 		/**
+		* Pending, non-expired jobs with the facts the unroutable probe needs:
+		* routing selectors, any recorded provisioning error, and the grace clock.
+		*
+		* Read-only — no claim, no `FOR UPDATE`; the probe never dispatches. Reuses
+		* the shared pending query so it inherits the same FIFO ordering and
+		* not-yet-expired filter the rest of the queue uses.
+		*/
+		async listUnroutableCandidates(limit) {
+			return (await this.pendingOldestFirstQuery().limit(limit).execute()).map((row) => ({
+				...rowToExpiredJobInfo(row),
+				unroutableSince: row.unroutable_since ? new Date(row.unroutable_since) : null
+			}));
+		}
+		/**
+		* Stamp the grace clock the first time a job reads unroutable.
+		*
+		* The `unroutable_since IS NULL` guard is load-bearing, not defensive: the
+		* cleanup/probe ticks are NOT leader-gated, so without it two coordinators
+		* would each re-stamp `now` on every tick, pushing the deadline outward
+		* forever and preventing the grace from ever elapsing.
+		*/
+		async markUnroutableSince(id, at) {
+			await this.db.updateTable("dispatch_queue").set({ unroutable_since: at }).where("id", "=", id).where("unroutable_since", "is", null).execute();
+		}
+		/** Clear the grace clock after the job reads routable again. */
+		async clearUnroutableState(id) {
+			await this.db.updateTable("dispatch_queue").set({ unroutable_since: null }).where("id", "=", id).execute();
+		}
+		/**
+		* Claim a still-pending row for fast-fail, moving it out of the queue.
+		*
+		* Mirrors {@link markExpired}: the queue row has to leave `Pending` in the
+		* same breath the job is terminalized, and for the same two reasons.
+		* A row left pending is still dispatchable, so an agent connecting later
+		* would pick up a job whose `execution_jobs` row already reads terminal; and
+		* the probe re-lists it on every tick, re-running the whole terminalize path
+		* (and re-counting the fast-fail metric) until the queue timeout finally
+		* expires it.
+		*
+		* The `status = Pending` guard is also the concurrency arbiter — probe ticks
+		* are NOT leader-gated, so exactly one coordinator's UPDATE hits a row and
+		* the losers get `false` and move on.
+		*
+		* @returns true when this call claimed the row, false when it was already
+		*   dispatched, cancelled, expired, or claimed by another coordinator.
+		*/
+		async claimUnroutable(id) {
+			const result = await this.db.updateTable("dispatch_queue").set({ status: "expired" }).where("id", "=", id).where("status", "=", "pending").executeTakeFirst();
+			this.depthCache = null;
+			this.breakdownCache = null;
+			return Number(result.numUpdatedRows ?? 0) > 0;
+		}
+		/**
 		* Convert a DB row to a QueuedJob object.
 		* Handles both auto-parsed JSONB arrays (from pg driver) and JSON strings (from tests).
 		*/
@@ -4732,6 +4798,82 @@ var init_job_queue = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/reporting/log-retention.ts
+/**
+* Delete step-log objects older than `ttlDays` in one bulk pass.
+*
+* Step-log objects are write-once (appended during the run, untouched after
+* finalize), so last-modified time is the correct expiry basis — a recent or
+* still-running run's objects were all written within the window and survive.
+* `ttlDays <= 0` disables the sweep (returns 0). Expired objects are collected
+* then bulk-deleted via `deleteMany` (S3 DeleteObjects), so a large sweep is a
+* handful of API calls, not one-per-object. A delete failure is logged and the
+* cleanup tick is not aborted.
+*
+* @returns Number of objects deleted.
+*/
+async function pruneExpiredLogs(storage, ttlDays, now = /* @__PURE__ */ new Date()) {
+	if (ttlDays <= 0) return 0;
+	const cutoff = now.getTime() - ttlDays * 864e5;
+	const expired = (await storage.listWithMetadata(LOG_ROOT_PREFIX)).filter((o) => o.lastModified.getTime() < cutoff).map((o) => o.path);
+	if (expired.length === 0) return 0;
+	try {
+		return await storage.deleteMany(expired);
+	} catch (err) {
+		logger$122.error("Failed to bulk-delete expired log objects", {
+			count: expired.length,
+			error: toErrorMessage(err)
+		});
+		return 0;
+	}
+}
+var logger$122, LOG_ROOT_PREFIX;
+var init_log_retention = __esmMin((() => {
+	logger$122 = createLogger({ prefix: "log-retention" });
+	LOG_ROOT_PREFIX = "executions/";
+}));
+//#endregion
+//#region src/pipeline/request-idempotency.ts
+/**
+* Atomically claim a run-minting request by its Platform `requestId`. Returns
+* the run id to use. `claimed: false` means a sibling coordinator already owns
+* this requestId (a relay failover re-sent the same request): the caller MUST
+* return `{ newRunId }` WITHOUT creating or dispatching a run, so one user
+* click yields exactly one run.
+*
+* Shared by `run.rerun.request` and `run.manual_schedule.request` — both mint a
+* fresh run and both ride the Platform's timeout-driven failover path. HA
+* coordinator siblings share one orchestrator DB, so the `INSERT … ON CONFLICT
+* (request_id) DO NOTHING` is the single point of arbitration: exactly one hop
+* inserts and wins; the loser reads back the winner's `new_run_id`.
+*/
+async function claimRequestId(db, requestId) {
+	const candidate = randomUUID();
+	if (await db.insertInto("request_idempotency").values({
+		request_id: requestId,
+		new_run_id: candidate
+	}).onConflict((oc) => oc.column("request_id").doNothing()).returning("new_run_id").executeTakeFirst()) return {
+		newRunId: candidate,
+		claimed: true
+	};
+	return {
+		newRunId: (await db.selectFrom("request_idempotency").select("new_run_id").where("request_id", "=", requestId).executeTakeFirstOrThrow()).new_run_id,
+		claimed: false
+	};
+}
+/**
+* Prune `request_idempotency` rows older than 1h. The request budget is ~10s,
+* so a claimed requestId is never re-sent after an hour; keeping the table
+* bounded avoids unbounded growth on a long-lived coordinator.
+*
+* @returns the number of rows deleted.
+*/
+async function pruneRequestIdempotency(db) {
+	const result = await db.deleteFrom("request_idempotency").where("created_at", "<", sql`now() - interval '1 hour'`).executeTakeFirst();
+	return Number(result.numDeletedRows ?? 0n);
+}
+var init_request_idempotency = __esmMin((() => {}));
+//#endregion
 //#region src/providers/github/auth.ts
 /**
 * GitHub clone token provider and authentication utilities.
@@ -5020,12 +5162,12 @@ function buildJobFailureDescription(data) {
 	if (data.error) return `Job error: ${data.error}`;
 	return "Job failed";
 }
-var logger$120, PROGRESS_DEBOUNCE_MS, CheckRunReporter;
+var logger$121, PROGRESS_DEBOUNCE_MS, CheckRunReporter;
 var init_check_run_reporter = __esmMin((() => {
 	init_auth();
 	init_prometheus();
 	init_check_run_summary();
-	logger$120 = createLogger({ prefix: "check-run-reporter" });
+	logger$121 = createLogger({ prefix: "check-run-reporter" });
 	PROGRESS_DEBOUNCE_MS = 5e3;
 	CheckRunReporter = class {
 		deps;
@@ -5116,7 +5258,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		setPending(opts) {
 			this.doSetPending(opts).catch((err) => {
-				logger$120.error("Failed to set pending check run", {
+				logger$121.error("Failed to set pending check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -5141,7 +5283,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		updateJobStatus(opts) {
 			this.doUpdateJobStatus(opts).catch((err) => {
-				logger$120.error("Failed to update job check run", {
+				logger$121.error("Failed to update job check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -5160,7 +5302,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		updateWorkflowStatus(opts) {
 			this.doUpdateWorkflowStatus(opts).catch((err) => {
-				logger$120.error("Failed to update workflow check run", {
+				logger$121.error("Failed to update workflow check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -5185,7 +5327,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		cleanupStaleCheckRuns(opts) {
 			this.doCleanupStaleCheckRuns(opts).catch((err) => {
-				logger$120.error("Failed to clean up stale check runs", {
+				logger$121.error("Failed to clean up stale check runs", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -5204,7 +5346,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		updateStepProgress(opts) {
 			this.doUpdateStepProgress(opts).catch((err) => {
-				logger$120.error("Failed to update step progress", {
+				logger$121.error("Failed to update step progress", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					workflowName: opts.workflowName,
@@ -5227,7 +5369,7 @@ var init_check_run_reporter = __esmMin((() => {
 			this.persistBuildCreationPending(key, opts.runId);
 			this.trackRunKey(opts.runId, key);
 			const creation = this.doSetBuildPending(opts).catch((err) => {
-				logger$120.error("Failed to set build pending check run", {
+				logger$121.error("Failed to set build pending check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -5246,7 +5388,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		setBuildComplete(opts) {
 			this.doSetBuildComplete(opts).catch((err) => {
-				logger$120.error("Failed to set build complete check run", {
+				logger$121.error("Failed to set build complete check run", {
 					error: toErrorMessage(err),
 					provider: opts.provider,
 					owner: opts.owner,
@@ -5298,7 +5440,7 @@ var init_check_run_reporter = __esmMin((() => {
 		*/
 		async recoverState() {
 			if (!this.deps.trackingStore) return;
-			logger$120.info("CheckRunReporter recovered (DB-backed state lookups enabled)");
+			logger$121.info("CheckRunReporter recovered (DB-backed state lookups enabled)");
 		}
 		/** Track a check run key associated with a runId for later cleanup. */
 		trackRunKey(runId, key) {
@@ -5340,7 +5482,7 @@ var init_check_run_reporter = __esmMin((() => {
 				await this.deps.trackingStore.setCheckRunId(this.parseKey(key), checkRunId, runId);
 				if (runId) await this.deps.trackingStore.markBuildCreationComplete(this.parseKey(key));
 			} catch (err) {
-				logger$120.warn("Failed to persist check_run_tracking row; cache-only fallback", {
+				logger$121.warn("Failed to persist check_run_tracking row; cache-only fallback", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -5360,7 +5502,7 @@ var init_check_run_reporter = __esmMin((() => {
 				if (fromDb !== void 0) this.checkRunIds.set(key, fromDb);
 				return fromDb;
 			} catch (err) {
-				logger$120.warn("Failed to read check_run_tracking row; treating as miss", {
+				logger$121.warn("Failed to read check_run_tracking row; treating as miss", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -5376,7 +5518,7 @@ var init_check_run_reporter = __esmMin((() => {
 			try {
 				await this.deps.trackingStore.setStepProgress(this.parseKey(key), steps, runId);
 			} catch (err) {
-				logger$120.warn("Failed to persist step-progress; cache-only fallback", {
+				logger$121.warn("Failed to persist step-progress; cache-only fallback", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -5391,7 +5533,7 @@ var init_check_run_reporter = __esmMin((() => {
 			try {
 				await this.deps.trackingStore.markInProgressSent(this.parseKey(key), runId);
 			} catch (err) {
-				logger$120.warn("Failed to persist in-progress-sent marker; cache-only fallback", {
+				logger$121.warn("Failed to persist in-progress-sent marker; cache-only fallback", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -5405,7 +5547,7 @@ var init_check_run_reporter = __esmMin((() => {
 			try {
 				await this.deps.trackingStore.markBuildCreationPending(this.parseKey(key), runId);
 			} catch (err) {
-				logger$120.warn("Failed to persist build-creation-pending marker", {
+				logger$121.warn("Failed to persist build-creation-pending marker", {
 					key,
 					error: toErrorMessage(err)
 				});
@@ -5471,12 +5613,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doSetPending(opts) {
 			if (opts.provider !== "github") {
-				logger$120.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$121.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$120.debug("GitHub config or installationId missing, skipping check run", {
+				logger$121.debug("GitHub config or installationId missing, skipping check run", {
 					hasConfig: !!githubConfig,
 					hasInstallationId: !!opts.installationId
 				});
@@ -5526,19 +5668,19 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doUpdateJobStatus(opts) {
 			if (opts.provider !== "github") {
-				logger$120.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$121.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$120.debug("GitHub config or installationId missing, skipping check run update");
+				logger$121.debug("GitHub config or installationId missing, skipping check run update");
 				return;
 			}
 			const checkName = `kici/${opts.workflowName}/job/${opts.jobName}`;
 			const key = this.checkRunKey(opts.owner, opts.repo, opts.sha, checkName);
 			const checkRunId = await this.resolveCheckRunId(key);
 			if (!checkRunId) {
-				logger$120.warn("Check run ID not found for job update, skipping", { key });
+				logger$121.warn("Check run ID not found for job update, skipping", { key });
 				return;
 			}
 			const pendingTimer = this.progressTimers.get(key);
@@ -5611,18 +5753,18 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doUpdateWorkflowStatus(opts) {
 			if (opts.provider !== "github") {
-				logger$120.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$121.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$120.debug("GitHub config or installationId missing, skipping check run update");
+				logger$121.debug("GitHub config or installationId missing, skipping check run update");
 				return;
 			}
 			const key = this.checkRunKey(opts.owner, opts.repo, opts.sha, `kici/${opts.workflowName}`);
 			const checkRunId = await this.resolveCheckRunId(key);
 			if (!checkRunId) {
-				logger$120.warn("Check run ID not found for workflow update, skipping", { key });
+				logger$121.warn("Check run ID not found for workflow update, skipping", { key });
 				return;
 			}
 			const octokit = createInstallationOctokit(githubConfig, opts.installationId);
@@ -5645,12 +5787,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doCleanupStaleCheckRuns(opts) {
 			if (opts.provider !== "github") {
-				logger$120.debug("Stale check run cleanup not supported for provider, skipping", { provider: opts.provider });
+				logger$121.debug("Stale check run cleanup not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig) {
-				logger$120.debug("GitHub config not available for stale cleanup, skipping", { routingKey: opts.routingKey });
+				logger$121.debug("GitHub config not available for stale cleanup, skipping", { routingKey: opts.routingKey });
 				return;
 			}
 			const appOctokit = new Octokit({
@@ -5668,7 +5810,7 @@ var init_check_run_reporter = __esmMin((() => {
 				});
 				installationId = data.id;
 			} catch (err) {
-				logger$120.warn("Could not find installation for repo, skipping stale cleanup", {
+				logger$121.warn("Could not find installation for repo, skipping stale cleanup", {
 					owner: opts.owner,
 					repo: opts.repo,
 					error: toErrorMessage(err)
@@ -5703,14 +5845,14 @@ var init_check_run_reporter = __esmMin((() => {
 					});
 					cleanedCount++;
 				} catch (updateErr) {
-					logger$120.warn("Failed to update stale check run", {
+					logger$121.warn("Failed to update stale check run", {
 						checkRunId: checkRun.id,
 						checkName: checkRun.name,
 						error: toErrorMessage(updateErr)
 					});
 				}
 				if (cleanedCount > 0) {
-					logger$120.info("Cleaned up stale check runs", {
+					logger$121.info("Cleaned up stale check runs", {
 						owner: opts.owner,
 						repo: opts.repo,
 						sha: opts.sha,
@@ -5720,7 +5862,7 @@ var init_check_run_reporter = __esmMin((() => {
 					githubCheckRunTotal.add(cleanedCount, { operation: "stale_cleanup" });
 				}
 			} catch (err) {
-				logger$120.error("Failed to list check runs for stale cleanup", {
+				logger$121.error("Failed to list check runs for stale cleanup", {
 					owner: opts.owner,
 					repo: opts.repo,
 					sha: opts.sha,
@@ -5786,7 +5928,7 @@ var init_check_run_reporter = __esmMin((() => {
 				const timer = setTimeout(() => {
 					this.progressTimers.delete(key);
 					this.flushProgress(key, opts).catch((err) => {
-						logger$120.error("Failed to flush step progress", {
+						logger$121.error("Failed to flush step progress", {
 							error: toErrorMessage(err),
 							key
 						});
@@ -5826,12 +5968,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doSetBuildPending(opts) {
 			if (opts.provider !== "github") {
-				logger$120.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$121.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$120.debug("GitHub config or installationId missing, skipping build check run", {
+				logger$121.debug("GitHub config or installationId missing, skipping build check run", {
 					hasConfig: !!githubConfig,
 					hasInstallationId: !!opts.installationId
 				});
@@ -5860,12 +6002,12 @@ var init_check_run_reporter = __esmMin((() => {
 		}
 		async doSetBuildComplete(opts) {
 			if (opts.provider !== "github") {
-				logger$120.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
+				logger$121.warn("Check runs not supported for provider, skipping", { provider: opts.provider });
 				return;
 			}
 			const githubConfig = this.resolveGithubConfig(opts.routingKey);
 			if (!githubConfig || !opts.installationId) {
-				logger$120.debug("GitHub config or installationId missing, skipping build check run update");
+				logger$121.debug("GitHub config or installationId missing, skipping build check run update");
 				return;
 			}
 			const buildCheckName = `kici/${opts.workflowName}/setup`;
@@ -5874,7 +6016,7 @@ var init_check_run_reporter = __esmMin((() => {
 			if (pending) await pending;
 			const checkRunId = await this.resolveCheckRunId(key);
 			if (!checkRunId) {
-				logger$120.warn("Check run ID not found for build update, skipping", { key });
+				logger$121.warn("Check run ID not found for build update, skipping", { key });
 				return;
 			}
 			const octokit = createInstallationOctokit(githubConfig, opts.installationId);
@@ -5930,7 +6072,7 @@ var init_check_run_reporter = __esmMin((() => {
 				};
 				default: {
 					const unexpected = status;
-					logger$120.warn("Unexpected terminal job status mapping a build conclusion", { status: unexpected });
+					logger$121.warn("Unexpected terminal job status mapping a build conclusion", { status: unexpected });
 					return {
 						conclusion: CheckRunConclusion.enum.failure,
 						description: customDescription ?? "Build finished with an unrecognised status"
@@ -5973,7 +6115,7 @@ var init_check_run_reporter = __esmMin((() => {
 				};
 				default: {
 					const unexpected = state;
-					logger$120.warn("Unexpected terminal job status mapping a job conclusion", { status: unexpected });
+					logger$121.warn("Unexpected terminal job status mapping a job conclusion", { status: unexpected });
 					return {
 						conclusion: CheckRunConclusion.enum.failure,
 						description: customDescription ?? "Job finished with an unrecognised status"
@@ -6016,7 +6158,7 @@ var init_check_run_reporter = __esmMin((() => {
 				};
 				default: {
 					const unexpected = status;
-					logger$120.warn("Unexpected terminal job status mapping a workflow conclusion", { status: unexpected });
+					logger$121.warn("Unexpected terminal job status mapping a workflow conclusion", { status: unexpected });
 					return {
 						conclusion: CheckRunConclusion.enum.failure,
 						description: customDescription ?? "Workflow finished with an unrecognised status"
@@ -6046,12 +6188,12 @@ var init_check_run_reporter = __esmMin((() => {
 				if (error.status === 403) {
 					const rateRemaining = error.response?.headers?.["x-ratelimit-remaining"];
 					const rateReset = error.response?.headers?.["x-ratelimit-reset"];
-					logger$120.error("GitHub API 403 creating check run", {
+					logger$121.error("GitHub API 403 creating check run", {
 						name: params.name,
 						rateRemaining,
 						rateReset
 					});
-				} else logger$120.error("GitHub API error creating check run", {
+				} else logger$121.error("GitHub API error creating check run", {
 					name: params.name,
 					status: error.status,
 					error: toErrorMessage(err)
@@ -6088,12 +6230,12 @@ var init_check_run_reporter = __esmMin((() => {
 				if (error.status === 403) {
 					const rateRemaining = error.response?.headers?.["x-ratelimit-remaining"];
 					const rateReset = error.response?.headers?.["x-ratelimit-reset"];
-					logger$120.error("GitHub API 403 updating check run", {
+					logger$121.error("GitHub API 403 updating check run", {
 						checkRunId: params.check_run_id,
 						rateRemaining,
 						rateReset
 					});
-				} else logger$120.error("GitHub API error updating check run", {
+				} else logger$121.error("GitHub API error updating check run", {
 					checkRunId: params.check_run_id,
 					status: error.status,
 					error: toErrorMessage(err)
@@ -6102,7 +6244,7 @@ var init_check_run_reporter = __esmMin((() => {
 			if (patchAccepted && params.status === "completed" && trackingKey && this.deps.trackingStore) try {
 				await this.deps.trackingStore.markTerminalSent(this.parseKey(trackingKey), trackingRunId);
 			} catch (err) {
-				logger$120.warn("Failed to stamp terminal_sent_at; continuing", {
+				logger$121.warn("Failed to stamp terminal_sent_at; continuing", {
 					key: trackingKey,
 					error: toErrorMessage(err)
 				});
@@ -6145,7 +6287,7 @@ function reportJobCheckRunCompletion(deps, input) {
 	try {
 		postJobCheckRunCompletion(deps, input);
 	} catch (err) {
-		logger$119.error("Failed to report job check-run completion", {
+		logger$120.error("Failed to report job check-run completion", {
 			error: toErrorMessage(err),
 			runId: input.runId,
 			jobId: input.jobId,
@@ -6157,7 +6299,7 @@ function postJobCheckRunCompletion(deps, input) {
 	if (!isTerminalJobStatus(input.status)) return;
 	const execContext = deps.getExecutionContext(input.runId);
 	if (!execContext) {
-		logger$119.debug("No execution context for job check-run completion, skipping", {
+		logger$120.debug("No execution context for job check-run completion, skipping", {
 			runId: input.runId,
 			jobId: input.jobId
 		});
@@ -6182,105 +6324,107 @@ function postJobCheckRunCompletion(deps, input) {
 		runId: input.runId
 	});
 }
-var logger$119;
+var logger$120;
 var init_job_check_run_completion = __esmMin((() => {
 	init_check_run_reporter();
-	logger$119 = createLogger({ prefix: "check-run-completion" });
+	logger$120 = createLogger({ prefix: "check-run-completion" });
 }));
 //#endregion
-//#region src/reporting/log-retention.ts
+//#region src/queue/terminalize-unroutable.ts
 /**
-* Delete step-log objects older than `ttlDays` in one bulk pass.
-*
-* Step-log objects are write-once (appended during the run, untouched after
-* finalize), so last-modified time is the correct expiry basis — a recent or
-* still-running run's objects were all written within the window and survive.
-* `ttlDays <= 0` disables the sweep (returns 0). Expired objects are collected
-* then bulk-deleted via `deleteMany` (S3 DeleteObjects), so a large sweep is a
-* handful of API calls, not one-per-object. A delete failure is logged and the
-* cleanup tick is not aborted.
-*
-* @returns Number of objects deleted.
+* The operator-facing reason a job is `unroutable`, naming the exact selectors
+* that went unmatched. Regex matchers are rendered as their source so the
+* message stays readable rather than printing `[object Object]`.
 */
-async function pruneExpiredLogs(storage, ttlDays, now = /* @__PURE__ */ new Date()) {
-	if (ttlDays <= 0) return 0;
-	const cutoff = now.getTime() - ttlDays * 864e5;
-	const expired = (await storage.listWithMetadata(LOG_ROOT_PREFIX)).filter((o) => o.lastModified.getTime() < cutoff).map((o) => o.path);
-	if (expired.length === 0) return 0;
-	try {
-		return await storage.deleteMany(expired);
-	} catch (err) {
-		logger$118.error("Failed to bulk-delete expired log objects", {
-			count: expired.length,
-			error: toErrorMessage(err)
-		});
-		return 0;
-	}
+function renderMatcher(m) {
+	return m.kind === "exact" ? m.value : `/${m.source}/${m.flags}`;
+}
+function unroutableMessage(job) {
+	const required = [...job.runsOnLabels, ...job.runsOnPatterns.map(renderMatcher)];
+	const excluded = [...job.excludeLabels, ...job.excludePatterns.map(renderMatcher)];
+	const parts = [required.length > 0 ? `runsOn [${required.join(", ")}]` : "this job (it declares no runsOn, so any agent would do)"];
+	if (excluded.length > 0) parts.push(`excluding [${excluded.join(", ")}]`);
+	return `No connected agent or scaler backend currently matches ${parts.join(" ")} — the job was never dispatched`;
 }
-var logger$118, LOG_ROOT_PREFIX;
-var init_log_retention = __esmMin((() => {
-	logger$118 = createLogger({ prefix: "log-retention" });
-	LOG_ROOT_PREFIX = "executions/";
-}));
-//#endregion
-//#region src/pipeline/request-idempotency.ts
 /**
-* Atomically claim a run-minting request by its Platform `requestId`. Returns
-* the run id to use. `claimed: false` means a sibling coordinator already owns
-* this requestId (a relay failover re-sent the same request): the caller MUST
-* return `{ newRunId }` WITHOUT creating or dispatching a run, so one user
-* click yields exactly one run.
+* Split the two reasons a queued job never ran: nothing in the fleet matched
+* its `runsOn` (`unroutable` — a label/fleet problem an operator has to fix)
+* versus something matched but never produced a usable agent
+* (`timed_out_stale` — a capacity or provisioning problem).
 *
-* Shared by `run.rerun.request` and `run.manual_schedule.request` — both mint a
-* fresh run and both ride the Platform's timeout-driven failover path. HA
-* coordinator siblings share one orchestrator DB, so the `INSERT … ON CONFLICT
-* (request_id) DO NOTHING` is the single point of arbitration: exactly one hop
-* inserts and wins; the loser reads back the winner's `new_run_id`.
+* Shared by the unroutable probe (which asks on a short tick, gated by a grace
+* window) and the queue-expiry sweep (which asks once at expiry, as the
+* backstop). One verdict, two moments in time — a second copy of this logic is
+* exactly the drift this module exists to prevent.
 */
-async function claimRequestId(db, requestId) {
-	const candidate = randomUUID();
-	if (await db.insertInto("request_idempotency").values({
-		request_id: requestId,
-		new_run_id: candidate
-	}).onConflict((oc) => oc.column("request_id").doNothing()).returning("new_run_id").executeTakeFirst()) return {
-		newRunId: candidate,
-		claimed: true
-	};
+function classifyUnroutable(job, canRouteLabels) {
+	const unroutable = job.lastProvisioningError === null && canRouteLabels !== void 0 && !canRouteLabels(job.runsOnLabels, job.runsOnPatterns, job.excludeLabels, job.excludePatterns);
 	return {
-		newRunId: (await db.selectFrom("request_idempotency").select("new_run_id").where("request_id", "=", requestId).executeTakeFirstOrThrow()).new_run_id,
-		claimed: false
+		unroutable,
+		status: unroutable ? ExecutionJobStatus.enum.unroutable : ExecutionJobStatus.enum.timed_out_stale,
+		errorMessage: unroutable ? unroutableMessage(job) : job.lastProvisioningError ?? GENERIC_MESSAGE
 	};
 }
 /**
-* Prune `request_idempotency` rows older than 1h. The request budget is ~10s,
-* so a claimed requestId is never re-sent after an hour; keeping the table
-* bounded avoids unbounded growth on a long-lived coordinator.
+* Settle one never-dispatched job: write the terminal status locally, surface
+* the reason at run level, forward to Platform, and resolve its check run.
 *
-* @returns the number of rows deleted.
+* @returns the run id when this call actually terminalized the job (so the
+* caller can complete the run), or null when another coordinator got there
+* first or the job was no longer pending.
 */
-async function pruneRequestIdempotency(db) {
-	const result = await db.deleteFrom("request_idempotency").where("created_at", "<", sql`now() - interval '1 hour'`).executeTakeFirst();
-	return Number(result.numDeletedRows ?? 0n);
+async function terminalizeUnroutableJob(deps, job) {
+	const { status, errorMessage, unroutable } = classifyUnroutable(job, deps.canRouteLabels);
+	try {
+		const ejResult = await deps.db.updateTable("execution_jobs").set({
+			status,
+			completed_at: /* @__PURE__ */ new Date(),
+			error_message: errorMessage
+		}).where("run_id", "=", sql`${job.runId}::uuid`).where("job_name", "=", job.jobName).where("status", "in", [ExecutionJobStatus.enum.pending, ExecutionJobStatus.enum.queued]).executeTakeFirst();
+		if (!ejResult.numUpdatedRows || ejResult.numUpdatedRows === 0n) return null;
+		const runReason = unroutable ? errorMessage : job.lastProvisioningError;
+		if (runReason) await deps.db.updateTable("execution_runs").set({ failure_reason: runReason }).where("run_id", "=", sql`${job.runId}::uuid`).where("failure_reason", "is", null).execute();
+		const ejRow = await deps.db.selectFrom("execution_jobs").select(["job_id"]).where("run_id", "=", sql`${job.runId}::uuid`).where("job_name", "=", job.jobName).executeTakeFirst();
+		if (ejRow) {
+			deps.executionTracker.updateInMemoryJob(job.runId, ejRow.job_id, status);
+			deps.executionTracker.forwardJobTerminalStatus(job.runId, ejRow.job_id, job.jobName, status, errorMessage);
+			deps.executionTracker.emitInfraEvent(job.runId, "orchestrator.job.queue_expired", {
+				jobId: ejRow.job_id,
+				metadata: {
+					jobName: job.jobName,
+					reason: errorMessage
+				}
+			});
+			if (deps.checkRunReporter) reportJobCheckRunCompletion({
+				checkRunReporter: deps.checkRunReporter,
+				getExecutionContext: (runId) => deps.executionTracker.getExecutionContext(runId)
+			}, {
+				runId: job.runId,
+				jobId: ejRow.job_id,
+				jobName: job.jobName,
+				status,
+				description: errorMessage
+			});
+		}
+		return job.runId;
+	} catch (err) {
+		logger$119.error("Failed to forward never-dispatched job status", {
+			runId: job.runId,
+			jobName: job.jobName,
+			error: toErrorMessage(err)
+		});
+		return null;
+	}
 }
-var init_request_idempotency = __esmMin((() => {}));
+var logger$119, GENERIC_MESSAGE;
+var init_terminalize_unroutable = __esmMin((() => {
+	init_job_check_run_completion();
+	logger$119 = createLogger({ prefix: "terminalize-unroutable" });
+	GENERIC_MESSAGE = "Queue timeout expired (job was never dispatched to an agent)";
+}));
 //#endregion
 //#region src/queue/cleanup.ts
 /**
-* The operator-facing reason an expired job is `unroutable`, naming the exact
-* selectors that went unmatched. Regex matchers are rendered as their source so
-* the message stays readable rather than printing `[object Object]`.
-*/
-function renderMatcher(m) {
-	return m.kind === "exact" ? m.value : `/${m.source}/${m.flags}`;
-}
-function unroutableMessage(job) {
-	const required = [...job.runsOnLabels, ...job.runsOnPatterns.map(renderMatcher)];
-	const excluded = [...job.excludeLabels, ...job.excludePatterns.map(renderMatcher)];
-	const parts = [required.length > 0 ? `runsOn [${required.join(", ")}]` : "this job (it declares no runsOn, so any agent would do)"];
-	if (excluded.length > 0) parts.push(`excluding [${excluded.join(", ")}]`);
-	return `No connected agent or scaler backend currently matches ${parts.join(" ")} — the job was never dispatched`;
-}
-/**
 * Run a single cleanup pass: remove expired dedup_cache entries and
 * mark expired dispatch_queue entries.
 *
@@ -6304,31 +6448,31 @@ async function runCleanup(dedup, queue, extras) {
 	if (extras) {
 		try {
 			const pruned = await pruneRequestIdempotency(extras.db);
-			if (pruned > 0) logger$117.info("Pruned stale request idempotency claims", { pruned });
+			if (pruned > 0) logger$118.info("Pruned stale request idempotency claims", { pruned });
 		} catch (err) {
-			logger$117.error("Failed to prune request idempotency claims", { error: toErrorMessage(err) });
+			logger$118.error("Failed to prune request idempotency claims", { error: toErrorMessage(err) });
 		}
 		const ttlDays = extras.dispatchQueueTtlDays ?? 30;
 		try {
 			dispatchRowsPruned = await queue.pruneTerminalDispatchRows(ttlDays);
 			if (dispatchRowsPruned > 0) {
 				dispatchQueueRowsPrunedTotal.add(dispatchRowsPruned);
-				logger$117.info("Pruned terminal dispatch_queue rows", {
+				logger$118.info("Pruned terminal dispatch_queue rows", {
 					dispatchRowsPruned,
 					ttlDays
 				});
 			}
 		} catch (err) {
-			logger$117.error("Failed to prune terminal dispatch_queue rows", { error: toErrorMessage(err) });
+			logger$118.error("Failed to prune terminal dispatch_queue rows", { error: toErrorMessage(err) });
 		}
 		if (extras.logStorage && extras.logStorageIsS3) try {
 			logObjectsPruned = await pruneExpiredLogs(extras.logStorage, extras.stepLogTtlDays ?? 90);
 			if (logObjectsPruned > 0) {
 				stepLogsPrunedTotal.add(logObjectsPruned);
-				logger$117.info("Pruned expired step-log objects", { logObjectsPruned });
+				logger$118.info("Pruned expired step-log objects", { logObjectsPruned });
 			}
 		} catch (err) {
-			logger$117.error("Failed to prune expired step-log objects", { error: toErrorMessage(err) });
+			logger$118.error("Failed to prune expired step-log objects", { error: toErrorMessage(err) });
 		}
 		if (extras.checkRunTrackingStore) {
 			const checkRunTtlDefault = extras.checkRunTrackingTtlDays ?? 7;
@@ -6337,81 +6481,44 @@ async function runCleanup(dedup, queue, extras) {
 				checkRunRowsPruned = await extras.checkRunTrackingStore.pruneStale(ttlDays);
 				if (checkRunRowsPruned > 0) {
 					checkRunTrackingRowsPrunedTotal.add(checkRunRowsPruned);
-					logger$117.info("Pruned stale check-run-tracking rows", {
+					logger$118.info("Pruned stale check-run-tracking rows", {
 						checkRunRowsPruned,
 						ttlDays
 					});
 				}
 			} catch (err) {
-				logger$117.error("Failed to prune stale check-run-tracking rows", { error: toErrorMessage(err) });
+				logger$118.error("Failed to prune stale check-run-tracking rows", { error: toErrorMessage(err) });
 			}
 		}
 	}
 	if (extras && expiredJobs.length > 0) {
 		const affectedRunIds = /* @__PURE__ */ new Set();
-		const genericMessage = "Queue timeout expired (job was never dispatched to an agent)";
 		for (const job of expiredJobs) {
-			const unroutable = job.lastProvisioningError === null && extras.canRouteLabels !== void 0 && !extras.canRouteLabels(job.runsOnLabels, job.runsOnPatterns, job.excludeLabels, job.excludePatterns);
-			const status = unroutable ? ExecutionJobStatus.enum.unroutable : ExecutionJobStatus.enum.timed_out_stale;
-			const errorMessage = unroutable ? unroutableMessage(job) : job.lastProvisioningError ?? genericMessage;
-			try {
-				const ejResult = await extras.db.updateTable("execution_jobs").set({
-					status,
-					completed_at: /* @__PURE__ */ new Date(),
-					error_message: errorMessage
-				}).where("run_id", "=", sql`${job.runId}::uuid`).where("job_name", "=", job.jobName).where("status", "in", [ExecutionJobStatus.enum.pending, ExecutionJobStatus.enum.queued]).executeTakeFirst();
-				if (ejResult.numUpdatedRows && ejResult.numUpdatedRows > 0n) {
-					const runReason = unroutable ? errorMessage : job.lastProvisioningError;
-					if (runReason) await extras.db.updateTable("execution_runs").set({ failure_reason: runReason }).where("run_id", "=", sql`${job.runId}::uuid`).where("failure_reason", "is", null).execute();
-					const ejRow = await extras.db.selectFrom("execution_jobs").select(["job_id"]).where("run_id", "=", sql`${job.runId}::uuid`).where("job_name", "=", job.jobName).executeTakeFirst();
-					if (ejRow) {
-						extras.executionTracker.updateInMemoryJob(job.runId, ejRow.job_id, status);
-						extras.executionTracker.forwardJobTerminalStatus(job.runId, ejRow.job_id, job.jobName, status, errorMessage);
-						extras.executionTracker.emitInfraEvent(job.runId, "orchestrator.job.queue_expired", {
-							jobId: ejRow.job_id,
-							metadata: {
-								jobName: job.jobName,
-								reason: errorMessage
-							}
-						});
-						if (extras.checkRunReporter) reportJobCheckRunCompletion({
-							checkRunReporter: extras.checkRunReporter,
-							getExecutionContext: (runId) => extras.executionTracker.getExecutionContext(runId)
-						}, {
-							runId: job.runId,
-							jobId: ejRow.job_id,
-							jobName: job.jobName,
-							status,
-							description: errorMessage
-						});
-					}
-					affectedRunIds.add(job.runId);
-				}
-			} catch (err) {
-				logger$117.error("Failed to forward expired job status", {
-					runId: job.runId,
-					jobName: job.jobName,
-					error: toErrorMessage(err)
-				});
-			}
+			const runId = await terminalizeUnroutableJob({
+				db: extras.db,
+				executionTracker: extras.executionTracker,
+				checkRunReporter: extras.checkRunReporter,
+				canRouteLabels: extras.canRouteLabels
+			}, job);
+			if (runId) affectedRunIds.add(runId);
 		}
 		for (const runId of affectedRunIds) try {
 			await extras.executionTracker.completeRunIfAllJobsTerminal(runId);
 		} catch (err) {
-			logger$117.error("Error checking run completion after queue expiry", {
+			logger$118.error("Error checking run completion after queue expiry", {
 				runId,
 				error: toErrorMessage(err)
 			});
 		}
 	}
-	if (dedupDeleted > 0 || queueExpired > 0 || dispatchRowsPruned > 0 || logObjectsPruned > 0 || checkRunRowsPruned > 0) logger$117.info("Cleanup completed", {
+	if (dedupDeleted > 0 || queueExpired > 0 || dispatchRowsPruned > 0 || logObjectsPruned > 0 || checkRunRowsPruned > 0) logger$118.info("Cleanup completed", {
 		dedupDeleted,
 		queueExpired,
 		dispatchRowsPruned,
 		logObjectsPruned,
 		checkRunRowsPruned
 	});
-	else logger$117.debug("Cleanup completed, nothing to clean");
+	else logger$118.debug("Cleanup completed, nothing to clean");
 	return {
 		dedupDeleted,
 		queueExpired,
@@ -6432,13 +6539,100 @@ function createCleanupHandler(dedup, queue, extras) {
 		await runCleanup(dedup, queue, extras);
 	};
 }
-var logger$117;
+var logger$118;
 var init_cleanup$1 = __esmMin((() => {
-	init_job_check_run_completion();
 	init_log_retention();
 	init_request_idempotency();
 	init_prometheus();
-	logger$117 = createLogger({ prefix: "cleanup" });
+	init_terminalize_unroutable();
+	logger$118 = createLogger({ prefix: "cleanup" });
+}));
+//#endregion
+//#region src/queue/unroutable-probe.ts
+/**
+* Probe cadence, derived from the grace rather than configured separately.
+*
+* The tick is an implementation detail of the grace window — it only has to be
+* fine-grained enough that the grace elapses on time — not independent policy,
+* so it deliberately does not earn its own cluster knob.
+*/
+function probeTickIntervalMs(graceMs) {
+	return Math.min(TICK_CEILING_MS, Math.max(TICK_FLOOR_MS, Math.floor(graceMs / 4)));
+}
+/**
+* Write the routing reason onto a job that is still waiting to be routed.
+*
+* The status guard matters: the reason is a statement about a job that has not
+* been picked up, so it must never annotate one that already started or
+* finished between the probe's read and this write.
+*/
+function makeRoutingReasonWriter(db) {
+	return async (runId, jobName, reason) => {
+		await db.updateTable("execution_jobs").set({ routing_reason: reason }).where("run_id", "=", sql`${runId}::uuid`).where("job_name", "=", jobName).where("status", "in", [ExecutionJobStatus.enum.pending, ExecutionJobStatus.enum.queued]).execute();
+	};
+}
+/**
+* Build the per-tick handler for the unroutable probe.
+*
+* The probe consults the SAME routability predicate the queue-expiry sweep uses
+* — one verdict, two moments in time — but asks on a short tick instead of once
+* an hour. On the first unroutable verdict it records the reason (so the cause
+* is visible while the job still waits) and starts a grace clock; only once the
+* job has been CONTINUOUSLY unroutable for the whole grace does it terminalize.
+* A job that reads routable again has both cleared, so a scaler reload or an
+* agent reconnect can never cost it its place in the queue.
+*/
+function createUnroutableProbeHandler(deps) {
+	return async () => {
+		const graceMs = await deps.getGraceMs();
+		if (graceMs <= 0) return;
+		const candidates = await deps.queue.listUnroutableCandidates(deps.batchLimit ?? DEFAULT_BATCH_LIMIT$1);
+		const now = Date.now();
+		for (const job of candidates) {
+			const verdict = classifyUnroutable(job, deps.canRouteLabels);
+			if (!verdict.unroutable) {
+				if (job.unroutableSince !== null) {
+					await deps.queue.clearUnroutableState(job.id);
+					await deps.setRoutingReason(job.runId, job.jobName, null);
+					logger$117.info("Job became routable again; cleared unroutable state", {
+						runId: job.runId,
+						jobName: job.jobName
+					});
+				}
+				continue;
+			}
+			if (job.unroutableSince === null) {
+				await deps.queue.markUnroutableSince(job.id, new Date(now));
+				await deps.setRoutingReason(job.runId, job.jobName, verdict.errorMessage);
+				logger$117.warn("Job is unroutable; starting grace window", {
+					runId: job.runId,
+					jobName: job.jobName,
+					graceMs,
+					reason: verdict.errorMessage
+				});
+				continue;
+			}
+			if (now - job.unroutableSince.getTime() >= graceMs) {
+				if (!await deps.queue.claimUnroutable(job.id)) continue;
+				await deps.terminalize(job);
+				deps.onFastFailed?.();
+				logger$117.warn("Job stayed unroutable for the whole grace window; failed it", {
+					runId: job.runId,
+					jobName: job.jobName,
+					graceMs
+				});
+			}
+		}
+	};
+}
+var logger$117, TICK_FLOOR_MS, TICK_CEILING_MS, DEFAULT_BATCH_LIMIT$1, DEFAULT_UNROUTABLE_GRACE_MS;
+var init_unroutable_probe = __esmMin((() => {
+	init_terminalize_unroutable();
+	logger$117 = createLogger({ prefix: "unroutable-probe" });
+	TICK_FLOOR_MS = 5e3;
+	TICK_CEILING_MS = 3e4;
+	DEFAULT_BATCH_LIMIT$1 = 200;
+	DEFAULT_UNROUTABLE_GRACE_MS = 12e4;
 }));
 //#endregion
 //#region src/metrics/scheduled-jobs.ts
@@ -6670,7 +6864,8 @@ var init_scheduled_job = __esmMin((() => {
 		"orphan-secret-cleanup",
 		"token-cleanup",
 		"cold-store-archive",
-		"cold-store-purge"
+		"cold-store-purge",
+		"unroutable-probe"
 	]);
 	ACCESS_LOG_ACTION_TICK_FAILURE = "scheduled_job.tick";
 	ACCESS_LOG_ACTION_TRIGGER = "scheduled_job.trigger";
@@ -6692,6 +6887,12 @@ function bootstrapOrchestratorScheduledJobs(deps, registrations) {
 		intervalMs: registrations.cleanup.intervalMs,
 		handler: registrations.cleanup.handler
 	}));
+	if (registrations.unroutableProbe) handles.push(registerOrchestratorScheduledJob({
+		...common,
+		name: "unroutable-probe",
+		intervalMs: registrations.unroutableProbe.intervalMs,
+		handler: registrations.unroutableProbe.handler
+	}));
 	if (registrations.orphanSecretCleanup) handles.push(registerOrchestratorScheduledJob({
 		...common,
 		name: "orphan-secret-cleanup",
@@ -18936,17 +19137,36 @@ var init_pg_secret_store = __esmMin((() => {
 			}
 			return result;
 		}
-		/**
-		* Set (create or update) a secret in a scope.
-		* Encrypts the value with AAD = "orgId:scope:key".
-		*/
 		/** Check if a scope is internal/operational (always allowed regardless of toggle). */
 		isInternalScope(scope) {
 			const colonIdx = scope.indexOf(":");
 			const path = colonIdx >= 0 ? scope.slice(colonIdx + 1) : scope;
 			return path.startsWith("__source__/") || path.startsWith("__webhook__/");
 		}
+		/**
+		* Set (create or update) a secret in a scope.
+		* Encrypts the value with AAD = "orgId:scope:key".
+		*
+		* Rejects a key outside `[A-Za-z0-9._-]` before doing anything else. The AAD
+		* is a plain concatenation, so a `:` in the key would let two distinct
+		* locations render one AAD (scope 'b' + key 'c:d' equals scope 'b:c' + key
+		* 'd') and a ciphertext written at one would authenticate at the other. The
+		* check sits ahead of the customerSecretsEnabled gate so internal scopes get
+		* no exemption — the binding has to hold for every writer.
+		*
+		* Callers pass a bare scope path, so the AAD's middle field is colon-free
+		* too: the admin route and the dashboard handler both run the scope
+		* validator immediately before calling in, and `source-store` builds its
+		* scope from a uuid. That precondition is what makes the whole triple
+		* recoverable, and it is the caller's to keep — this method does not
+		* re-check it.
+		*
+		* Write-path only: getSecrets, listKeys, deleteSecret, deleteScope,
+		* renameScope, getAllSecrets and createScope stay unvalidated, which is what
+		* keeps a key stored before this rule readable and deletable.
+		*/
 		async setSecret(orgId, scope, key, value) {
+			assertValidSecretKey(key);
 			if (!this.customerSecretsEnabled && !this.isInternalScope(scope)) throw new Error("PG customer secrets are disabled. Use an external secret backend or enable pgCustomerSecrets in config.");
 			const aad = `${orgId}:${scope}:${key}`;
 			const encrypted = encrypt(value, this.masterKey, this.keyVersion, aad);
@@ -20910,10 +21130,10 @@ var init_admin_sources = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/001_initial.ts
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$106,
-	up: () => up$106
+	down: () => down$107,
+	up: () => up$107
 });
-async function up$106(db) {
+async function up$107(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -20935,7 +21155,7 @@ async function up$106(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$106(db) {
+async function down$107(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -21655,8 +21875,8 @@ var init__001_initial = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$105,
-	up: () => up$105
+	down: () => down$106,
+	up: () => up$106
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -21670,13 +21890,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$105(db) {
+async function up$106(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$105(db) {
+async function down$106(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -21686,8 +21906,8 @@ var init__002_config_versions_key_version = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$104,
-	up: () => up$104
+	down: () => down$105,
+	up: () => up$105
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -21711,7 +21931,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$104(db) {
+async function up$105(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -21749,21 +21969,21 @@ async function up$104(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$104(db) {
+async function down$105(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 var init__003_access_log = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$103,
-	up: () => up$103
+	down: () => down$104,
+	up: () => up$104
 });
-async function up$103(db) {
+async function up$104(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$103(db) {
+async function down$104(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
@@ -21771,8 +21991,8 @@ var init__004_rename_bundle_to_source = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$102,
-	up: () => up$102
+	down: () => down$103,
+	up: () => up$103
 });
 /**
 * Cold-store chunk counter table.
@@ -21789,7 +22009,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$102(db) {
+async function up$103(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -21807,15 +22027,15 @@ async function up$102(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$102(db) {
+async function down$103(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 var init__005_cold_store_chunk_counter = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$101,
-	up: () => up$101
+	down: () => down$102,
+	up: () => up$102
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -21851,7 +22071,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$101(db) {
+async function up$102(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -21896,7 +22116,7 @@ async function up$101(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$101(db) {
+async function down$102(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -21922,8 +22142,8 @@ var init__006_runs_jobs_steps_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$100,
-	up: () => up$100
+	down: () => down$101,
+	up: () => up$101
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -21963,7 +22183,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$100(db) {
+async function up$101(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -21984,7 +22204,7 @@ async function up$100(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$100(db) {
+async function down$101(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -22013,8 +22233,8 @@ var init__007_audit_logs_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$99,
-	up: () => up$99
+	down: () => down$100,
+	up: () => up$100
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -22052,7 +22272,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$99(db) {
+async function up$100(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -22068,7 +22288,7 @@ async function up$99(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$99(db) {
+async function down$100(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -22088,8 +22308,8 @@ var init__008_event_log_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$98,
-	up: () => up$98
+	down: () => down$99,
+	up: () => up$99
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -22102,7 +22322,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$98(db) {
+async function up$99(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -22111,15 +22331,15 @@ async function up$98(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$98(db) {
+async function down$99(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 var init__009_access_log_trigram = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$97,
-	up: () => up$97
+	down: () => down$98,
+	up: () => up$98
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -22151,7 +22371,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$97(db) {
+async function up$98(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -22178,15 +22398,15 @@ async function up$97(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$97(db) {
+async function down$98(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 var init__010_cold_store_chunks = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$96,
-	up: () => up$96
+	down: () => down$97,
+	up: () => up$97
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -22205,11 +22425,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$96(db) {
+async function up$97(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$96(db) {
+async function down$97(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -22249,8 +22469,8 @@ var init__011_drop_source_secrets_notify = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$95,
-	up: () => up$95
+	down: () => down$96,
+	up: () => up$96
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -22276,7 +22496,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$95(db) {
+async function up$96(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -22294,15 +22514,15 @@ async function up$95(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$95(db) {
+async function down$96(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 var init__012_peer_credentials_active_uniq = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$94,
-	up: () => up$94
+	down: () => down$95,
+	up: () => up$95
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -22321,7 +22541,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$94(db) {
+async function up$95(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -22331,7 +22551,7 @@ async function up$94(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$94(db) {
+async function down$95(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
@@ -22339,8 +22559,8 @@ var init__013_execution_log_bytes = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$93,
-	up: () => up$93
+	down: () => down$94,
+	up: () => up$94
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -22374,7 +22594,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$93(db) {
+async function up$94(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -22405,7 +22625,7 @@ async function up$93(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$93(db) {
+async function down$94(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -22424,8 +22644,8 @@ var init__014_kici_events_lease_retry = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$92,
-	up: () => up$92
+	down: () => down$93,
+	up: () => up$93
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -22453,7 +22673,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$92(db) {
+async function up$93(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -22578,7 +22798,7 @@ async function up$92(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$92(db) {
+async function down$93(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -22604,8 +22824,8 @@ var init__015_org_settings_customer_scoped = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$91,
-	up: () => up$91
+	down: () => down$92,
+	up: () => up$92
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -22618,7 +22838,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$91(db) {
+async function up$92(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -22632,7 +22852,7 @@ async function up$91(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$91(db) {
+async function down$92(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -22641,13 +22861,13 @@ var init__016_org_settings_allow_http_npm = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$90,
-	up: () => up$90
+	down: () => down$91,
+	up: () => up$91
 });
-async function up$90(db) {
+async function up$91(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$90(db) {
+async function down$91(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 var ORG_ID_TABLES$1;
@@ -22666,14 +22886,14 @@ var init__017_org_id_widen = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$89,
-	up: () => up$89
+	down: () => down$90,
+	up: () => up$90
 });
-async function up$89(db) {
+async function up$90(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$89(db) {
+async function down$90(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
@@ -22699,8 +22919,8 @@ var init__018_org_id_prefix_backfill = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$88,
-	up: () => up$88
+	down: () => down$89,
+	up: () => up$89
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -22723,7 +22943,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$88(db) {
+async function up$89(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -22744,7 +22964,7 @@ async function up$88(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$88(db) {
+async function down$89(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
@@ -22752,8 +22972,8 @@ var init__019_generic_sources_change_notify = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$87,
-	up: () => up$87
+	down: () => down$88,
+	up: () => up$88
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -22768,7 +22988,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$87(db) {
+async function up$88(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -22782,7 +23002,7 @@ async function up$87(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$87(db) {
+async function down$88(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -22791,8 +23011,8 @@ var init__020_org_settings_dashboard_write_policy = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$86,
-	up: () => up$86
+	down: () => down$87,
+	up: () => up$87
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -22816,7 +23036,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$86(db) {
+async function up$87(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -22847,15 +23067,15 @@ async function up$86(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$86(db) {
+async function down$87(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 var init__021_check_run_tracking = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$85,
-	up: () => up$85
+	down: () => down$86,
+	up: () => up$86
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -22882,7 +23102,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$85(db) {
+async function up$86(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -22932,7 +23152,7 @@ async function up$85(db) {
     `.execute(db);
 	}
 }
-async function down$85(db) {
+async function down$86(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -22941,8 +23161,8 @@ var init__022_scaler_manager_state = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$84,
-	up: () => up$84
+	down: () => down$85,
+	up: () => up$85
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -22966,7 +23186,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$84(db) {
+async function up$85(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -22991,7 +23211,7 @@ async function up$84(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$84(db) {
+async function down$85(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -23004,8 +23224,8 @@ var init__023_dispatch_queue_recovery_deadline = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$83,
-	up: () => up$83
+	down: () => down$84,
+	up: () => up$84
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -23021,7 +23241,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$83(db) {
+async function up$84(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -23037,7 +23257,7 @@ async function up$83(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$83(db) {
+async function down$84(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -23046,8 +23266,8 @@ var init__024_dispatch_queue_provisioning_error = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$82,
-	up: () => up$82
+	down: () => down$83,
+	up: () => up$83
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -23061,7 +23281,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$82(db) {
+async function up$83(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -23081,7 +23301,7 @@ async function up$82(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$82(db) {
+async function down$83(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -23093,8 +23313,8 @@ var init__025_init_failure = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$81,
-	up: () => up$81
+	down: () => down$82,
+	up: () => up$82
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -23103,7 +23323,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$81(db) {
+async function up$82(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -23113,7 +23333,7 @@ async function up$81(db) {
     ])))
   `.execute(db);
 }
-async function down$81(db) {
+async function down$82(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -23127,8 +23347,8 @@ var init__026_event_log_lockfile_corrupt = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$80,
-	up: () => up$80
+	down: () => down$81,
+	up: () => up$81
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -23146,13 +23366,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$80(db) {
+async function up$81(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$80(db) {
+async function down$81(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -23161,8 +23381,8 @@ var init__027_workflow_timeout = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$79,
-	up: () => up$79
+	down: () => down$80,
+	up: () => up$80
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -23181,7 +23401,7 @@ var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has either column skips it.
 */
-async function columnExists$5(db, column) {
+async function columnExists$6(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -23191,17 +23411,17 @@ async function columnExists$5(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$79(db) {
-	if (!await columnExists$5(db, "user_cache_quota_bytes")) await sql`
+async function up$80(db) {
+	if (!await columnExists$6(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
     `.execute(db);
-	if (!await columnExists$5(db, "user_cache_ttl_ms")) await sql`
+	if (!await columnExists$6(db, "user_cache_ttl_ms")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$79(db) {
+async function down$80(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -23213,8 +23433,8 @@ var init__028_org_settings_user_cache = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$78,
-	up: () => up$78
+	down: () => down$79,
+	up: () => up$79
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -23228,7 +23448,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$78(db) {
+async function up$79(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -23241,7 +23461,7 @@ async function up$78(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$78(db) {
+async function down$79(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -23250,8 +23470,8 @@ var init__029_dispatch_queue_attempts = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$77,
-	up: () => up$77
+	down: () => down$78,
+	up: () => up$78
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -23262,14 +23482,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$77(db) {
+async function up$78(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$77(db) {
+async function down$78(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -23280,8 +23500,8 @@ var init__030_held_runs_env_set_null = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$76,
-	up: () => up$76
+	down: () => down$77,
+	up: () => up$77
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -23298,7 +23518,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$76(db) {
+async function up$77(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -23323,7 +23543,7 @@ async function up$76(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$76(db) {
+async function down$77(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -23332,8 +23552,8 @@ var init__031_dispatch_queue_ack_deadline = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$75,
-	up: () => up$75
+	down: () => down$76,
+	up: () => up$76
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -23345,7 +23565,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$75(db) {
+async function up$76(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -23359,7 +23579,7 @@ async function up$75(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$75(db) {
+async function down$76(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -23368,8 +23588,8 @@ var init__032_org_settings_dispatch_ack_timeout = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$74,
-	up: () => up$74
+	down: () => down$75,
+	up: () => up$75
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -23386,7 +23606,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$74(db) {
+async function up$75(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -23406,7 +23626,7 @@ async function up$74(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$74(db) {
+async function down$75(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -23418,8 +23638,8 @@ var init__033_org_settings_approval = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$73,
-	up: () => up$73
+	down: () => down$74,
+	up: () => up$74
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -23441,7 +23661,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$73(db) {
+async function up$74(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -23474,7 +23694,7 @@ async function up$73(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$73(db) {
+async function down$74(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -23485,8 +23705,8 @@ var init__034_held_runs_generalize = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$72,
-	up: () => up$72
+	down: () => down$73,
+	up: () => up$73
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -23495,7 +23715,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$72(db) {
+async function up$73(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -23505,15 +23725,15 @@ async function up$72(db) {
     )
   `.execute(db);
 }
-async function down$72(db) {
+async function down$73(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 var init__035_pending_workflow_contexts = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$71,
-	up: () => up$71
+	down: () => down$72,
+	up: () => up$72
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -23526,7 +23746,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$71(db) {
+async function up$72(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -23552,15 +23772,15 @@ async function up$71(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$71(db) {
+async function down$72(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 var init__036_attestations = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$70,
-	up: () => up$70
+	down: () => down$71,
+	up: () => up$71
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -23577,7 +23797,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$70(db) {
+async function up$71(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -23593,7 +23813,7 @@ async function up$70(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$70(db) {
+async function down$71(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -23613,8 +23833,8 @@ var init__037_generic_sources_provider_type_local = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$69,
-	up: () => up$69
+	down: () => down$70,
+	up: () => up$70
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -23626,7 +23846,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$69(db) {
+async function up$70(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -23645,15 +23865,15 @@ async function up$69(db) {
     )
   `.execute(db);
 }
-async function down$69(db) {
+async function down$70(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 var init__038_remote_sources = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$68,
-	up: () => up$68
+	down: () => down$69,
+	up: () => up$69
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -23670,7 +23890,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$68(db) {
+async function up$69(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -23700,15 +23920,15 @@ async function up$68(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$68(db) {
+async function down$69(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 var init__039_host_roster = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$67,
-	up: () => up$67
+	down: () => down$68,
+	up: () => up$68
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -23735,7 +23955,7 @@ async function colExists$12(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$67(db) {
+async function up$68(db) {
 	if (!await colExists$12(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
 	if (!await colExists$12(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
 	if (!await colExists$12(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
@@ -23746,7 +23966,7 @@ async function up$67(db) {
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$67(db) {
+async function down$68(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -23757,8 +23977,8 @@ var init__040_runsonall_pin = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$66,
-	up: () => up$66
+	down: () => down$67,
+	up: () => up$67
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -23788,7 +24008,7 @@ async function colExists$11(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$66(db) {
+async function up$67(db) {
 	if (!await colExists$11(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
 	if (!await colExists$11(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
 	if (!await colExists$11(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
@@ -23797,7 +24017,7 @@ async function up$66(db) {
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$66(db) {
+async function down$67(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -23807,8 +24027,8 @@ var init__041_wave_gated = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$65,
-	up: () => up$65
+	down: () => down$66,
+	up: () => up$66
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -23834,11 +24054,11 @@ async function colExists$10(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$65(db) {
+async function up$66(db) {
 	if (!await colExists$10(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 	if (!await colExists$10(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$65(db) {
+async function down$66(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
@@ -23846,8 +24066,8 @@ var init__042_dispatch_queue_patterns = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$64,
-	up: () => up$64
+	down: () => down$65,
+	up: () => up$65
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -23868,18 +24088,18 @@ async function colExists$9(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$64(db) {
+async function up$65(db) {
 	if (!await colExists$9(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$64(db) {
+async function down$65(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 var init__043_rerouted_to_peer = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$63,
-	up: () => up$63
+	down: () => down$64,
+	up: () => up$64
 });
 /**
 * Add idempotent check-mode columns:
@@ -23906,13 +24126,13 @@ async function colExists$8(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$63(db) {
+async function up$64(db) {
 	if (!await colExists$8(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
 	if (!await colExists$8(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
 	if (!await colExists$8(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
 	if (!await colExists$8(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$63(db) {
+async function down$64(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -23922,8 +24142,8 @@ var init__044_check_mode = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$62,
-	up: () => up$62
+	down: () => down$63,
+	up: () => up$63
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -23937,19 +24157,19 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive column).
 */
-async function up$62(db) {
+async function up$63(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$62(db) {
+async function down$63(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 var init__045_host_properties = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$61,
-	up: () => up$61
+	down: () => down$62,
+	up: () => up$62
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -23964,19 +24184,19 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive nullable column).
 */
-async function up$61(db) {
+async function up$62(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$61(db) {
+async function down$62(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 var init__046_join_token_consumed_by_instance = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$60,
-	up: () => up$60
+	down: () => down$61,
+	up: () => up$61
 });
 async function colExists$7(db, table, name) {
 	return (await sql`
@@ -23988,7 +24208,7 @@ async function colExists$7(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$60(db) {
+async function up$61(db) {
 	if (!await colExists$7(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
@@ -24007,7 +24227,7 @@ async function up$60(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$60(db) {
+async function down$61(db) {
 	if (!await colExists$7(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
@@ -24036,8 +24256,8 @@ var init__047_needs_run_on = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$59,
-	up: () => up$59
+	down: () => down$60,
+	up: () => up$60
 });
 /**
 * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
@@ -24054,19 +24274,19 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$59(db) {
+async function up$60(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$59(db) {
+async function down$60(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 var init__048_host_reboot_pending = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$58,
-	up: () => up$58
+	down: () => down$59,
+	up: () => up$59
 });
 /**
 * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
@@ -24078,19 +24298,19 @@ var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$58(db) {
+async function up$59(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$58(db) {
+async function down$59(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 var init__049_held_runs_payload = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$57,
-	up: () => up$57
+	down: () => down$58,
+	up: () => up$58
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -24105,19 +24325,19 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$57(db) {
+async function up$58(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down$57(db) {
+async function down$58(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 var init__050_sources_slug = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/051_binding_host_pattern.ts
 var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$56,
-	up: () => up$56
+	down: () => down$57,
+	up: () => up$57
 });
 /**
 * Add a per-host dimension to environment secret bindings:
@@ -24133,7 +24353,7 @@ var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has the column / index is a no-op.
 * Additive — staging data is preserved.
 */
-async function up$56(db) {
+async function up$57(db) {
 	await sql`ALTER TABLE public.environment_bindings
     ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
@@ -24141,7 +24361,7 @@ async function up$56(db) {
 	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
     ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
 }
-async function down$56(db) {
+async function down$57(db) {
 	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
     DROP COLUMN IF EXISTS host_pattern`.execute(db);
@@ -24152,8 +24372,8 @@ var init__051_binding_host_pattern = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/052_host_reach_metadata.ts
 var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$55,
-	up: () => up$55
+	down: () => down$56,
+	up: () => up$56
 });
 /**
 * Add pre-agent reach metadata to the host roster so a declared host (no agent
@@ -24170,14 +24390,14 @@ var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
 * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
 * so staging data is preserved.
 */
-async function up$55(db) {
+async function up$56(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS address text,
     ADD COLUMN IF NOT EXISTS ssh_user text,
     ADD COLUMN IF NOT EXISTS ssh_port integer,
     ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
 }
-async function down$55(db) {
+async function down$56(db) {
 	await sql`ALTER TABLE public.host_roster
     DROP COLUMN IF EXISTS address,
     DROP COLUMN IF EXISTS ssh_user,
@@ -24188,8 +24408,8 @@ var init__052_host_reach_metadata = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/053_agent_token_single_use.ts
 var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$54,
-	up: () => up$54
+	down: () => down$55,
+	up: () => up$55
 });
 /**
 * Add a single-use marker to agent tokens for the bootstrap (init-runner)
@@ -24204,11 +24424,11 @@ var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$54(db) {
+async function up$55(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
 }
-async function down$54(db) {
+async function down$55(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS consumed_at`.execute(db);
 }
@@ -24216,8 +24436,8 @@ var init__053_agent_token_single_use = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/054_local_working_tree.ts
 var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$53,
-	up: () => up$53
+	down: () => down$54,
+	up: () => up$54
 });
 /**
 * Mark runs that executed an uploaded local working tree (`kici run remote`):
@@ -24230,11 +24450,11 @@ var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
 * data is preserved.
 */
-async function up$53(db) {
+async function up$54(db) {
 	await sql`ALTER TABLE public.execution_runs
     ADD COLUMN IF NOT EXISTS local_working_tree boolean NOT NULL DEFAULT false`.execute(db);
 }
-async function down$53(db) {
+async function down$54(db) {
 	await sql`ALTER TABLE public.execution_runs
     DROP COLUMN IF EXISTS local_working_tree`.execute(db);
 }
@@ -24242,8 +24462,8 @@ var init__054_local_working_tree = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/055_agent_token_mandatory_labels.ts
 var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$52,
-	up: () => up$52
+	down: () => down$53,
+	up: () => up$53
 });
 /**
 * Add a token-bound mandatory-label taint to agent tokens:
@@ -24259,11 +24479,11 @@ var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$52(db) {
+async function up$53(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS mandatory_labels text`.execute(db);
 }
-async function down$52(db) {
+async function down$53(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS mandatory_labels`.execute(db);
 }
@@ -24271,8 +24491,8 @@ var init__055_agent_token_mandatory_labels = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/056_execution_jobs_environments.ts
 var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$51,
-	up: () => up$51
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * Add a per-job bound deployment-environment list to `execution_jobs`:
@@ -24287,11 +24507,11 @@ var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$51(db) {
+async function up$52(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS environments text`.execute(db);
 }
-async function down$51(db) {
+async function down$52(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS environments`.execute(db);
 }
@@ -24299,8 +24519,8 @@ var init__056_execution_jobs_environments = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/057_step_concurrency.ts
 var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$50,
-	up: () => up$50
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Add parallel step-group concurrency columns to `execution_steps`:
@@ -24323,11 +24543,11 @@ async function colExists$6(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$50(db) {
+async function up$51(db) {
 	if (!await colExists$6(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
 	if (!await colExists$6(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
 }
-async function down$50(db) {
+async function down$51(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
 }
@@ -24335,8 +24555,8 @@ var init__057_step_concurrency = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/058_access_log_agent_label.ts
 var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Add `access_log.agent_label text` — the human-set name of the agent that
@@ -24356,18 +24576,18 @@ async function colExists$5(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$49(db) {
+async function up$50(db) {
 	if (!await colExists$5(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
 }
-async function down$49(db) {
+async function down$50(db) {
 	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
 }
 var init__058_access_log_agent_label = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/059_attestation_verdict.ts
 var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Add server-side verification verdict columns to `attestations`, plus the
@@ -24394,7 +24614,7 @@ async function colExists$4(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$48(db) {
+async function up$49(db) {
 	if (await colExists$4(db, "attestations", "verify_status")) return;
 	await sql`
     ALTER TABLE public.attestations
@@ -24407,7 +24627,7 @@ async function up$48(db) {
 	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
 	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
 }
-async function down$48(db) {
+async function down$49(db) {
 	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
@@ -24423,8 +24643,8 @@ var init__059_attestation_verdict = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/060_run_trigger_actor.ts
 var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Add the triggering-actor columns to `execution_runs`:
@@ -24452,12 +24672,12 @@ async function colExists$3(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$47(db) {
+async function up$48(db) {
 	if (!await colExists$3(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
 	if (!await colExists$3(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
 	if (!await colExists$3(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
 }
-async function down$47(db) {
+async function down$48(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
@@ -24466,8 +24686,8 @@ var init__060_run_trigger_actor = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/061_execution_runs_environment_id.ts
 var _061_execution_runs_environment_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Add `environment_id` to `execution_runs` so environment run-history can be
@@ -24503,7 +24723,7 @@ async function colExists$2(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$46(db) {
+async function up$47(db) {
 	if (!await colExists$2(db, "execution_runs", "environment_id")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN environment_id uuid
@@ -24525,7 +24745,7 @@ async function up$46(db) {
              WHERE e2.type = 'fixed' AND e2.name = er.environment) = 1
   `.execute(db);
 }
-async function down$46(db) {
+async function down$47(db) {
 	await sql`DROP INDEX IF EXISTS idx_execution_runs_environment_id`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS environment_id`.execute(db);
 }
@@ -24533,8 +24753,8 @@ var init__061_execution_runs_environment_id = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/062_execution_runs_agent_label.ts
 var _062_execution_runs_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * Add the agent-provenance columns to `execution_runs`:
@@ -24559,11 +24779,11 @@ async function colExists$1(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$45(db) {
+async function up$46(db) {
 	if (!await colExists$1(db, "execution_runs", "triggered_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN triggered_by_agent_label text`.execute(db);
 	if (!await colExists$1(db, "execution_runs", "cancelled_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN cancelled_by_agent_label text`.execute(db);
 }
-async function down$45(db) {
+async function down$46(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS triggered_by_agent_label`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelled_by_agent_label`.execute(db);
 }
@@ -24571,8 +24791,8 @@ var init__062_execution_runs_agent_label = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/063_access_log_agent_label_index.ts
 var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Index `access_log.agent_label` (column added by migration 058) so the
@@ -24580,18 +24800,18 @@ var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
 * the dashboard "agent name" filter) does an indexed exact-match lookup
 * instead of a scan. Idempotent.
 */
-async function up$44(db) {
+async function up$45(db) {
 	await sql`CREATE INDEX IF NOT EXISTS access_log_agent_label_idx ON public.access_log (agent_label)`.execute(db);
 }
-async function down$44(db) {
+async function down$45(db) {
 	await sql`DROP INDEX IF EXISTS access_log_agent_label_idx`.execute(db);
 }
 var init__063_access_log_agent_label_index = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/064_execution_jobs_skipped_environments.ts
 var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * Add the test-run skipped-environment columns to `execution_jobs`:
@@ -24606,13 +24826,13 @@ var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportA
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$43(db) {
+async function up$44(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS skipped_environments text`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS env_warning text`.execute(db);
 }
-async function down$43(db) {
+async function down$44(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS skipped_environments`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
@@ -24622,8 +24842,8 @@ var init__064_execution_jobs_skipped_environments = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/065_pending_attestations.ts
 var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * Add the `pending_attestations` deferred-attestation outbox and an idempotency
@@ -24643,7 +24863,7 @@ var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$42(db) {
+async function up$43(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -24682,7 +24902,7 @@ async function up$42(db) {
       ON public.attestations (run_id, job_id, subject_digest)
   `.execute(db);
 }
-async function down$42(db) {
+async function down$43(db) {
 	await sql`DROP INDEX IF EXISTS uq_attestations_run_job_subject`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.pending_attestations`.execute(db);
 }
@@ -24690,8 +24910,8 @@ var init__065_pending_attestations = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/066_pending_attestations_rejected.ts
 var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
@@ -24702,21 +24922,21 @@ var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$41(db) {
-	if (await columnExists$4(db, "pending_attestations", "rejected_at")) return;
+async function up$42(db) {
+	if (await columnExists$5(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
       ADD COLUMN rejected_at TIMESTAMPTZ
   `.execute(db);
 }
-async function down$41(db) {
-	if (!await columnExists$4(db, "pending_attestations", "rejected_at")) return;
+async function down$42(db) {
+	if (!await columnExists$5(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
       DROP COLUMN rejected_at
   `.execute(db);
 }
-async function columnExists$4(db, table, column) {
+async function columnExists$5(db, table, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -24728,8 +24948,8 @@ var init__066_pending_attestations_rejected = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/067_environments_to_contexts.ts
 var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Rename the named-policy object from "environment" to "context" across the
@@ -24763,7 +24983,7 @@ var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
 * columns automatically (Postgres references them by identity, not name), so
 * only the one hand-named index above needs an explicit rename.
 */
-async function up$40(db) {
+async function up$41(db) {
 	await sql`ALTER TABLE public.environments RENAME TO contexts`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings RENAME TO context_bindings`.execute(db);
 	await sql`ALTER TABLE public.environment_variables RENAME TO context_variables`.execute(db);
@@ -24782,7 +25002,7 @@ async function up$40(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'context'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'context'`.execute(db);
 }
-async function down$40(db) {
+async function down$41(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'environment'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'environment'`.execute(db);
 	await sql`UPDATE public.held_runs SET trigger_source = 'environment' WHERE trigger_source = 'context'`.execute(db);
@@ -24805,8 +25025,8 @@ var init__067_environments_to_contexts = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/068_request_idempotency.ts
 var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Add the `request_idempotency` claim table: a `request_id`-keyed record that
@@ -24821,12 +25041,12 @@ var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$39(db) {
+async function up$40(db) {
 	if (await tableExists$3(db, "request_idempotency")) return;
 	await db.schema.createTable("request_idempotency").addColumn("request_id", "text", (c) => c.primaryKey()).addColumn("new_run_id", "text", (c) => c.notNull()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("idx_request_idempotency_created_at").on("request_idempotency").column("created_at").execute();
 }
-async function down$39(db) {
+async function down$40(db) {
 	await db.schema.dropTable("request_idempotency").ifExists().execute();
 }
 async function tableExists$3(db, table) {
@@ -24841,8 +25061,8 @@ var init__068_request_idempotency = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/069_reroute_tunables.ts
 var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Add the three reroute-tunable columns to `org_settings` (all nullable):
@@ -24861,12 +25081,12 @@ var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: each column add is guarded on column existence, so a re-run on a
 * DB that already has a column is a no-op for that column.
 */
-async function up$38(db) {
+async function up$39(db) {
 	await addColumnIfMissing(db, "reroute_spawn_window_ms", "BIGINT");
 	await addColumnIfMissing(db, "reroute_ack_timeout_ms", "BIGINT");
 	await addColumnIfMissing(db, "reroute_max_hops", "INTEGER");
 }
-async function down$38(db) {
+async function down$39(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_spawn_window_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_ack_timeout_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_max_hops`.execute(db);
@@ -24886,8 +25106,8 @@ var init__069_reroute_tunables = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/070_execution_runs_failure_class.ts
 var _070_execution_runs_failure_class_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Add `execution_runs.failure_class` — the reason a terminal run failed
@@ -24908,18 +25128,18 @@ async function colExists(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$37(db) {
+async function up$38(db) {
 	if (!await colExists(db, "execution_runs", "failure_class")) await sql`ALTER TABLE public.execution_runs ADD COLUMN failure_class text`.execute(db);
 }
-async function down$37(db) {
+async function down$38(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS failure_class`.execute(db);
 }
 var init__070_execution_runs_failure_class = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/071_batch_accumulation.ts
 var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add the batch-accumulation tables that back the `workflows_failed_batch`
@@ -24943,7 +25163,7 @@ var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$36(db) {
+async function up$37(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -24988,7 +25208,7 @@ async function up$36(db) {
       ON public.batch_accumulation_items (window_id)
   `.execute(db);
 }
-async function down$36(db) {
+async function down$37(db) {
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_items`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_windows`.execute(db);
 }
@@ -24996,8 +25216,8 @@ var init__071_batch_accumulation = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/072_dispatch_queue_run_id_index.ts
 var _072_dispatch_queue_run_id_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Add `idx_dispatch_queue_run_id` on `dispatch_queue (run_id)`.
@@ -25010,21 +25230,21 @@ var _072_dispatch_queue_run_id_index_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
 */
-async function up$35(db) {
+async function up$36(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_run_id
       ON public.dispatch_queue (run_id)
   `.execute(db);
 }
-async function down$35(db) {
+async function down$36(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_run_id`.execute(db);
 }
 var init__072_dispatch_queue_run_id_index = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/073_org_settings_ingest_concurrency.ts
 var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Add `org_settings.ingest_max_concurrency BIGINT` (nullable).
@@ -25035,7 +25255,7 @@ var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$34(db) {
+async function up$35(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25049,7 +25269,7 @@ async function up$34(db) {
       ADD COLUMN ingest_max_concurrency BIGINT
   `.execute(db);
 }
-async function down$34(db) {
+async function down$35(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS ingest_max_concurrency
   `.execute(db);
@@ -25058,8 +25278,8 @@ var init__073_org_settings_ingest_concurrency = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/074_normalize_zero_concurrency_limit.ts
 var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Normalize degenerate context concurrency limits. A `concurrency_limit` of 0
@@ -25070,16 +25290,16 @@ var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll(
 * Idempotent; down() is a no-op (a normalized 0 cannot — and should not — be
 * restored).
 */
-async function up$33(db) {
+async function up$34(db) {
 	await sql`UPDATE public.contexts SET concurrency_limit = NULL WHERE concurrency_limit <= 0`.execute(db);
 }
-async function down$33(_db) {}
+async function down$34(_db) {}
 var init__074_normalize_zero_concurrency_limit = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/075_ingest_overflow_buffer.ts
 var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Durable overflow buffer for shed webhook-ingest deliveries.
@@ -25093,7 +25313,7 @@ var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$32(db) {
+async function up$33(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -25126,15 +25346,15 @@ async function up$32(db) {
       ON public.ingest_overflow_buffer (delivery_id)
   `.execute(db);
 }
-async function down$32(db) {
+async function down$33(db) {
 	await sql`DROP TABLE IF EXISTS public.ingest_overflow_buffer`.execute(db);
 }
 var init__075_ingest_overflow_buffer = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/076_artifacts.ts
 var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Add the `artifacts` table for user-facing build artifacts and the per-org
@@ -25151,7 +25371,7 @@ var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table / columns is a no-op.
 */
-async function up$31(db) {
+async function up$32(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -25187,7 +25407,7 @@ async function up$31(db) {
       ADD COLUMN IF NOT EXISTS artifact_ttl_ms BIGINT
   `.execute(db);
 }
-async function down$31(db) {
+async function down$32(db) {
 	await sql`DROP TABLE IF EXISTS public.artifacts`.execute(db);
 	await sql`
     ALTER TABLE public.org_settings
@@ -25199,8 +25419,8 @@ var init__076_artifacts = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/077_backup_runs.ts
 var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add the `backup_runs` table: one row per successful `kici-admin db backup`,
@@ -25211,12 +25431,12 @@ var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$30(db) {
+async function up$31(db) {
 	if (await tableExists$2(db, "backup_runs")) return;
 	await db.schema.createTable("backup_runs").addColumn("id", "bigserial", (c) => c.primaryKey()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("dump_path", "text", (c) => c.notNull()).addColumn("byte_size", "bigint", (c) => c.notNull()).addColumn("secret_key_version", "integer").addColumn("pg_server_version", "text", (c) => c.notNull()).addColumn("migrations_hash", "text", (c) => c.notNull()).addColumn("hostname", "text", (c) => c.notNull()).execute();
 	await db.schema.createIndex("idx_backup_runs_created_at").on("backup_runs").column("created_at").execute();
 }
-async function down$30(db) {
+async function down$31(db) {
 	await db.schema.dropTable("backup_runs").ifExists().execute();
 }
 async function tableExists$2(db, table) {
@@ -25231,8 +25451,8 @@ var init__077_backup_runs = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/078_org_settings_backup_staleness.ts
 var _078_org_settings_backup_staleness_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add the nullable `org_settings.backup_staleness_warn_hours INTEGER` column:
@@ -25242,7 +25462,7 @@ var _078_org_settings_backup_staleness_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$29(db) {
+async function up$30(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25256,7 +25476,7 @@ async function up$29(db) {
       ADD COLUMN backup_staleness_warn_hours INTEGER
   `.execute(db);
 }
-async function down$29(db) {
+async function down$30(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS backup_staleness_warn_hours
   `.execute(db);
@@ -25265,8 +25485,8 @@ var init__078_org_settings_backup_staleness = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/079_org_settings_scaler_spawn_timeout.ts
 var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable).
@@ -25278,7 +25498,7 @@ var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$28(db) {
+async function up$29(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25292,7 +25512,7 @@ async function up$28(db) {
       ADD COLUMN scaler_spawn_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$28(db) {
+async function down$29(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS scaler_spawn_timeout_ms
   `.execute(db);
@@ -25301,8 +25521,8 @@ var init__079_org_settings_scaler_spawn_timeout = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/080_cluster_settings.ts
 var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Create `cluster_settings`: a single-row (id='default') table of fleet-wide
@@ -25317,7 +25537,7 @@ var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$27(db) {
+async function up$28(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -25341,15 +25561,15 @@ async function up$27(db) {
     )
   `.execute(db);
 }
-async function down$27(db) {
+async function down$28(db) {
 	await sql`DROP TABLE IF EXISTS public.cluster_settings`.execute(db);
 }
 var init__080_cluster_settings = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/081_org_settings_queue_timeout.ts
 var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add `org_settings.queue_timeout_ms BIGINT` (nullable).
@@ -25366,7 +25586,7 @@ var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$26(db) {
+async function up$27(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25380,7 +25600,7 @@ async function up$26(db) {
       ADD COLUMN queue_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$26(db) {
+async function down$27(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS queue_timeout_ms
   `.execute(db);
@@ -25389,8 +25609,8 @@ var init__081_org_settings_queue_timeout = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/082_host_s3_reachable.ts
 var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add `host_roster.s3_reachable BOOLEAN` (nullable).
@@ -25404,7 +25624,7 @@ var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$25(db) {
+async function up$26(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25418,7 +25638,7 @@ async function up$25(db) {
       ADD COLUMN s3_reachable BOOLEAN
   `.execute(db);
 }
-async function down$25(db) {
+async function down$26(db) {
 	await sql`
     ALTER TABLE public.host_roster DROP COLUMN IF EXISTS s3_reachable
   `.execute(db);
@@ -25427,8 +25647,8 @@ var init__082_host_s3_reachable = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/083_org_settings_artifact_caps.ts
 var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add `org_settings.artifact_max_bytes` + `artifact_max_per_run` (both nullable
@@ -25444,7 +25664,7 @@ var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has a
 * column is a no-op.
 */
-async function up$24(db) {
+async function up$25(db) {
 	for (const col of ["artifact_max_bytes", "artifact_max_per_run"]) {
 		if ((await sql`
       SELECT EXISTS (
@@ -25457,7 +25677,7 @@ async function up$24(db) {
 		await sql`ALTER TABLE public.org_settings ADD COLUMN ${sql.ref(col)} BIGINT`.execute(db);
 	}
 }
-async function down$24(db) {
+async function down$25(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_bytes`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_per_run`.execute(db);
 }
@@ -25465,8 +25685,8 @@ var init__083_org_settings_artifact_caps = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/084_orchestrator_signing_keys.ts
 var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Add the `orchestrator_signing_keys` table: the cluster-scoped, long-lived
@@ -25484,12 +25704,12 @@ var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$23(db) {
+async function up$24(db) {
 	if (await tableExists$1(db, "orchestrator_signing_keys")) return;
 	await db.schema.createTable("orchestrator_signing_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_jwk", "text").addColumn("key_version", "integer", (c) => c.notNull().defaultTo(1)).addColumn("alg", "text", (c) => c.notNull()).addColumn("signer_kind", "text", (c) => c.notNull()).addColumn("key_ref", "text").addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("retired_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_orch_signing_keys_status").on("orchestrator_signing_keys").column("status").execute();
 }
-async function down$23(db) {
+async function down$24(db) {
 	await db.schema.dropTable("orchestrator_signing_keys").ifExists().execute();
 }
 async function tableExists$1(db, table) {
@@ -25504,8 +25724,8 @@ var init__084_orchestrator_signing_keys = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/085_cluster_settings_reroute_flap_grace_ms.ts
 var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add `cluster_settings.reroute_flap_grace_ms` (nullable BIGINT).
@@ -25515,7 +25735,7 @@ var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __expo
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$22(db) {
+async function up$23(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25526,15 +25746,15 @@ async function up$22(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN reroute_flap_grace_ms BIGINT`.execute(db);
 }
-async function down$22(db) {
+async function down$23(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS reroute_flap_grace_ms`.execute(db);
 }
 var init__085_cluster_settings_reroute_flap_grace_ms = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/086_cluster_settings_max_fanout_hosts.ts
 var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add `cluster_settings.max_fanout_hosts` (nullable INTEGER).
@@ -25544,7 +25764,7 @@ var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$21(db) {
+async function up$22(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25555,15 +25775,15 @@ async function up$21(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN max_fanout_hosts INTEGER`.execute(db);
 }
-async function down$21(db) {
+async function down$22(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS max_fanout_hosts`.execute(db);
 }
 var init__086_cluster_settings_max_fanout_hosts = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/087_cluster_settings_event_router_rate_limit.ts
 var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add `cluster_settings.event_router_rate_limit_per_workflow_per_minute` (nullable INTEGER).
@@ -25573,7 +25793,7 @@ var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __ex
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$20(db) {
+async function up$21(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25584,15 +25804,15 @@ async function up$20(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN event_router_rate_limit_per_workflow_per_minute INTEGER`.execute(db);
 }
-async function down$20(db) {
+async function down$21(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS event_router_rate_limit_per_workflow_per_minute`.execute(db);
 }
 var init__087_cluster_settings_event_router_rate_limit = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/088_cluster_settings_cache_max_tarball_bytes.ts
 var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Add `cluster_settings.cache_max_tarball_bytes` (nullable BIGINT).
@@ -25602,7 +25822,7 @@ var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __ex
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$19(db) {
+async function up$20(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25613,15 +25833,15 @@ async function up$19(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_max_tarball_bytes BIGINT`.execute(db);
 }
-async function down$19(db) {
+async function down$20(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_max_tarball_bytes`.execute(db);
 }
 var init__088_cluster_settings_cache_max_tarball_bytes = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/089_cluster_settings_cache_ttl_days.ts
 var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Add `cluster_settings.cache_ttl_days` (nullable INTEGER).
@@ -25631,7 +25851,7 @@ var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$18(db) {
+async function up$19(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25642,15 +25862,15 @@ async function up$18(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_ttl_days INTEGER`.execute(db);
 }
-async function down$18(db) {
+async function down$19(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_ttl_days`.execute(db);
 }
 var init__089_cluster_settings_cache_ttl_days = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/090_cluster_settings_concurrency_wait_timeout_ms.ts
 var _090_cluster_settings_concurrency_wait_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add `cluster_settings.concurrency_wait_timeout_ms` (nullable BIGINT).
@@ -25660,7 +25880,7 @@ var _090_cluster_settings_concurrency_wait_timeout_ms_exports = /* @__PURE__ */
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$17(db) {
+async function up$18(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25671,15 +25891,15 @@ async function up$17(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN concurrency_wait_timeout_ms BIGINT`.execute(db);
 }
-async function down$17(db) {
+async function down$18(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS concurrency_wait_timeout_ms`.execute(db);
 }
 var init__090_cluster_settings_concurrency_wait_timeout_ms = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/091_cluster_settings_agent_token_ttl_ms.ts
 var _091_cluster_settings_agent_token_ttl_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add `cluster_settings.agent_token_ttl_ms` (nullable BIGINT).
@@ -25689,7 +25909,7 @@ var _091_cluster_settings_agent_token_ttl_ms_exports = /* @__PURE__ */ __exportA
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$16(db) {
+async function up$17(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25700,15 +25920,15 @@ async function up$16(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN agent_token_ttl_ms BIGINT`.execute(db);
 }
-async function down$16(db) {
+async function down$17(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS agent_token_ttl_ms`.execute(db);
 }
 var init__091_cluster_settings_agent_token_ttl_ms = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/092_cluster_settings_version.ts
 var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add `cluster_settings.version` (monotonic BIGINT, bumped on each settings
@@ -25722,7 +25942,7 @@ var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$15(db) {
+async function up$16(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25733,15 +25953,15 @@ async function up$15(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN version BIGINT NOT NULL DEFAULT 0`.execute(db);
 }
-async function down$15(db) {
+async function down$16(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS version`.execute(db);
 }
 var init__092_cluster_settings_version = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/093_org_settings_sandbox_allowlist.ts
 var _093_org_settings_sandbox_allowlist_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Add the per-org container-sandbox escape-hatch allow-list to `org_settings`:
@@ -25759,7 +25979,7 @@ var _093_org_settings_sandbox_allowlist_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has a column skips that column.
 */
-async function columnExists$3(db, column) {
+async function columnExists$4(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25769,17 +25989,17 @@ async function columnExists$3(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$14(db) {
-	if (!await columnExists$3(db, "sandbox_allowed_capabilities")) await sql`
+async function up$15(db) {
+	if (!await columnExists$4(db, "sandbox_allowed_capabilities")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN sandbox_allowed_capabilities TEXT[]
     `.execute(db);
-	if (!await columnExists$3(db, "sandbox_allow_host_network")) await sql`
+	if (!await columnExists$4(db, "sandbox_allow_host_network")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN sandbox_allow_host_network BOOLEAN
     `.execute(db);
 }
-async function down$14(db) {
+async function down$15(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS sandbox_allowed_capabilities
   `.execute(db);
@@ -25791,8 +26011,8 @@ var init__093_org_settings_sandbox_allowlist = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/094_dashboard_encryption_keys.ts
 var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Add the `dashboard_encryption_keys` table: the cluster-scoped, long-lived
@@ -25811,12 +26031,12 @@ var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$13(db) {
+async function up$14(db) {
 	if (await tableExists(db, "dashboard_encryption_keys")) return;
 	await db.schema.createTable("dashboard_encryption_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_key", "text", (c) => c.notNull()).addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_dashboard_encryption_keys_status").on("dashboard_encryption_keys").column("status").execute();
 }
-async function down$13(db) {
+async function down$14(db) {
 	await db.schema.dropTable("dashboard_encryption_keys").ifExists().execute();
 }
 async function tableExists(db, table) {
@@ -25831,8 +26051,8 @@ var init__094_dashboard_encryption_keys = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/095_dashboard_write_policy_tristate.ts
 var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Migrate stored `org_settings.dashboard_write_policy` JSONB from the legacy
@@ -25850,7 +26070,7 @@ var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
 * Pure SQL rewrite: for each row, rebuild the object keeping only non-`true`
 * entries and mapping `false` → `'disabled'`, leaving existing string values.
 */
-async function up$12(db) {
+async function up$13(db) {
 	await sql`
     UPDATE org_settings
        SET dashboard_write_policy = COALESCE(
@@ -25877,13 +26097,13 @@ async function up$12(db) {
        )
   `.execute(db);
 }
-async function down$12() {}
+async function down$13() {}
 var init__095_dashboard_write_policy_tristate = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/096_multi_schedule_cron_last_fired.ts
 var _096_multi_schedule_cron_last_fired_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Track cron last-fired per (registration, schedule) instead of per
@@ -25898,7 +26118,7 @@ var _096_multi_schedule_cron_last_fired_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on an already-migrated DB skips each step.
 */
-async function columnExists$2(db, column) {
+async function columnExists$3(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25918,8 +26138,8 @@ async function primaryKeyColumns(db) {
      ORDER BY a.attnum
   `.execute(db)).rows.map((row) => row.attname);
 }
-async function up$11(db) {
-	if (!await columnExists$2(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired ADD COLUMN schedule_key text`.execute(db);
+async function up$12(db) {
+	if (!await columnExists$3(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired ADD COLUMN schedule_key text`.execute(db);
 	await sql`
     UPDATE public.cron_last_fired clf
        SET schedule_key = k.key
@@ -25945,7 +26165,7 @@ async function up$11(db) {
     `.execute(db);
 	}
 }
-async function down$11(db) {
+async function down$12(db) {
 	await sql`
     DELETE FROM public.cron_last_fired a
       USING public.cron_last_fired b
@@ -25957,14 +26177,14 @@ async function down$11(db) {
     ALTER TABLE public.cron_last_fired
       ADD CONSTRAINT cron_last_fired_pkey PRIMARY KEY (registration_id)
   `.execute(db);
-	if (await columnExists$2(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired DROP COLUMN schedule_key`.execute(db);
+	if (await columnExists$3(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired DROP COLUMN schedule_key`.execute(db);
 }
 var init__096_multi_schedule_cron_last_fired = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/097_execution_runs_pr_number.ts
 var _097_execution_runs_pr_number_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add `pr_number INTEGER NULL` to `execution_runs`.
@@ -25977,7 +26197,7 @@ var _097_execution_runs_pr_number_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function columnExists$1(db, column) {
+async function columnExists$2(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -25987,13 +26207,13 @@ async function columnExists$1(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$10(db) {
-	if (!await columnExists$1(db, "pr_number")) await sql`
+async function up$11(db) {
+	if (!await columnExists$2(db, "pr_number")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN pr_number INTEGER
     `.execute(db);
 }
-async function down$10(db) {
+async function down$11(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS pr_number
   `.execute(db);
@@ -26002,8 +26222,8 @@ var init__097_execution_runs_pr_number = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/098_execution_runs_customer_id.ts
 var _098_execution_runs_customer_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Denormalize the owning org onto `execution_runs` so the concurrency-gate
@@ -26021,7 +26241,7 @@ var _098_execution_runs_customer_id_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running skips the column when it already exists.
 */
-async function columnExists(db, column) {
+async function columnExists$1(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -26031,8 +26251,8 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$9(db) {
-	if (!await columnExists(db, "customer_id")) {
+async function up$10(db) {
+	if (!await columnExists$1(db, "customer_id")) {
 		await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN customer_id TEXT NOT NULL DEFAULT '__default__'
@@ -26055,7 +26275,7 @@ async function up$9(db) {
       ON public.execution_runs (customer_id, context)
   `.execute(db);
 }
-async function down$9(db) {
+async function down$10(db) {
 	await sql`DROP INDEX IF EXISTS execution_runs_customer_id_context_idx`.execute(db);
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS customer_id
@@ -26065,8 +26285,8 @@ var init__098_execution_runs_customer_id = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/099_cluster_settings_dashboard_verified_issuer.ts
 var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add `cluster_settings.dashboard_verified_issuer` (nullable text).
@@ -26085,7 +26305,7 @@ var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$8(db) {
+async function up$9(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -26096,15 +26316,15 @@ async function up$8(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN dashboard_verified_issuer TEXT`.execute(db);
 }
-async function down$8(db) {
+async function down$9(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS dashboard_verified_issuer`.execute(db);
 }
 var init__099_cluster_settings_dashboard_verified_issuer = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/100_held_runs_hold_type_vocabulary.ts
 var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Realign `held_runs.hold_type` onto the engine's `HoldType` vocabulary.
@@ -26123,7 +26343,7 @@ var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a second run matches no rows.
 */
-async function up$7(db) {
+async function up$8(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'reviewer' WHERE hold_type = 'approval'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'timer' WHERE hold_type = 'wait_timer'`.execute(db);
 }
@@ -26137,7 +26357,7 @@ async function up$7(db) {
 * `wait_timer` alone, so leaving those rows spelled `timer` would strand them
 * in the expire-and-fail path.
 */
-async function down$7(db) {
+async function down$8(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'approval' WHERE hold_type = 'reviewer'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'wait_timer' WHERE hold_type = 'timer'`.execute(db);
 }
@@ -26145,8 +26365,8 @@ var init__100_held_runs_hold_type_vocabulary = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/101_contexts_hold_expiry_drop_default.ts
 var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Give the context hold expiry a single default, and retire the stored zeroes.
@@ -26167,7 +26387,7 @@ var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll
 * Idempotent: dropping an absent default is a no-op and the UPDATE matches no
 * rows on a second run.
 */
-async function up$6(db) {
+async function up$7(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds DROP DEFAULT`.execute(db);
 	await sql`UPDATE public.contexts SET hold_expiry_seconds = NULL WHERE hold_expiry_seconds = 0`.execute(db);
 }
@@ -26179,15 +26399,15 @@ async function up$6(db) {
 * back to `0` would resume cancelling every hold on its context — so a
 * rollback keeps them on the fallback rather than re-breaking them.
 */
-async function down$6(db) {
+async function down$7(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds SET DEFAULT 86400`.execute(db);
 }
 var init__101_contexts_hold_expiry_drop_default = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/102_dispatch_queue_agent_id.ts
 var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Add `dispatch_queue.agent_id` (nullable text).
@@ -26205,7 +26425,7 @@ var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$5(db) {
+async function up$6(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -26216,15 +26436,15 @@ async function up$5(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.dispatch_queue ADD COLUMN agent_id TEXT`.execute(db);
 }
-async function down$5(db) {
+async function down$6(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS agent_id`.execute(db);
 }
 var init__102_dispatch_queue_agent_id = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/103_cluster_settings_ownership_db_check_timeout_ms.ts
 var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Add `cluster_settings.ownership_db_check_timeout_ms` (nullable bigint).
@@ -26242,7 +26462,7 @@ var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ *
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$4(db) {
+async function up$5(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -26253,15 +26473,15 @@ async function up$4(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN ownership_db_check_timeout_ms BIGINT`.execute(db);
 }
-async function down$4(db) {
+async function down$5(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ownership_db_check_timeout_ms`.execute(db);
 }
 var init__103_cluster_settings_ownership_db_check_timeout_ms = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/104_check_run_terminal_sent.ts
 var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Add `check_run_tracking.terminal_sent_at` (nullable timestamptz).
@@ -26281,7 +26501,7 @@ var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$3(db) {
+async function up$4(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -26292,15 +26512,15 @@ async function up$3(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.check_run_tracking ADD COLUMN terminal_sent_at TIMESTAMPTZ`.execute(db);
 }
-async function down$3(db) {
+async function down$4(db) {
 	await sql`ALTER TABLE public.check_run_tracking DROP COLUMN IF EXISTS terminal_sent_at`.execute(db);
 }
 var init__104_check_run_terminal_sent = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/105_org_trust_policy.ts
 var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
@@ -26317,7 +26537,7 @@ var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
 */
-async function up$2(db) {
+async function up$3(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.org_trust_policy (
       customer_id                TEXT PRIMARY KEY,
@@ -26330,15 +26550,15 @@ async function up$2(db) {
     )
   `.execute(db);
 }
-async function down$2(db) {
+async function down$3(db) {
 	await sql`DROP TABLE IF EXISTS public.org_trust_policy`.execute(db);
 }
 var init__105_org_trust_policy = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.ts
 var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * Add `cluster_settings.check_run_tracking_ttl_days` (nullable integer).
@@ -26354,7 +26574,7 @@ var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */
 * Idempotent: guarded on column existence; a re-run on a database that already
 * has the column is a no-op.
 */
-async function up$1(db) {
+async function up$2(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -26365,15 +26585,15 @@ async function up$1(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN check_run_tracking_ttl_days INTEGER`.execute(db);
 }
-async function down$1(db) {
+async function down$2(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS check_run_tracking_ttl_days`.execute(db);
 }
 var init__106_cluster_settings_check_run_tracking_ttl_days = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/107_check_run_tracking_updated_at_index.ts
 var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
@@ -26394,17 +26614,63 @@ var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
 */
-async function up(db) {
+async function up$1(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_check_run_tracking_updated_at
       ON public.check_run_tracking (updated_at)
   `.execute(db);
 }
-async function down(db) {
+async function down$1(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_check_run_tracking_updated_at`.execute(db);
 }
 var init__107_check_run_tracking_updated_at_index = __esmMin((() => {}));
 //#endregion
+//#region src/db/migrations/108_unroutable_fast_fail.ts
+var _108_unroutable_fast_fail_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Fast-fail support for jobs nothing in the fleet can run.
+*
+* Three additive, nullable columns:
+*
+* - `cluster_settings.unroutable_grace_ms` — how long a job may stay
+*   continuously unroutable before it is terminalized. NULL means the
+*   orchestrator's configured default applies; 0 disables fast-fail and leaves
+*   the `queue_timeout_ms` backstop as the only path.
+* - `dispatch_queue.unroutable_since` — when the job first read unroutable.
+*   Persisted rather than in-memory so a restart mid-grace resumes the same
+*   clock instead of resetting it; an orchestrator that bounces every 90s must
+*   not be able to keep a genuinely dead job alive forever. Cleared the moment
+*   the job reads routable again.
+* - `execution_jobs.routing_reason` — the operator-facing reason, visible while
+*   the job is still queued. Cleared on recovery.
+*
+* Idempotent: each column is guarded on existence, so a re-run is a no-op.
+*/
+async function columnExists(db, table, column) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${column}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists === true;
+}
+async function up(db) {
+	if (!await columnExists(db, "cluster_settings", "unroutable_grace_ms")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN unroutable_grace_ms INTEGER`.execute(db);
+	if (!await columnExists(db, "dispatch_queue", "unroutable_since")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN unroutable_since TIMESTAMPTZ`.execute(db);
+	if (!await columnExists(db, "execution_jobs", "routing_reason")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN routing_reason TEXT`.execute(db);
+}
+async function down(db) {
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS routing_reason`.execute(db);
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS unroutable_since`.execute(db);
+	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS unroutable_grace_ms`.execute(db);
+}
+var init__108_unroutable_fast_fail = __esmMin((() => {}));
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -26515,7 +26781,8 @@ function createMigrationProvider() {
 			"104_check_run_terminal_sent": _104_check_run_terminal_sent_exports,
 			"105_org_trust_policy": _105_org_trust_policy_exports,
 			"106_cluster_settings_check_run_tracking_ttl_days": _106_cluster_settings_check_run_tracking_ttl_days_exports,
-			"107_check_run_tracking_updated_at_index": _107_check_run_tracking_updated_at_index_exports
+			"107_check_run_tracking_updated_at_index": _107_check_run_tracking_updated_at_index_exports,
+			"108_unroutable_fast_fail": _108_unroutable_fast_fail_exports
 		};
 	} };
 }
@@ -26627,6 +26894,7 @@ var init_migration_provider = __esmMin((() => {
 	init__105_org_trust_policy();
 	init__106_cluster_settings_check_run_tracking_ttl_days();
 	init__107_check_run_tracking_updated_at_index();
+	init__108_unroutable_fast_fail();
 }));
 //#endregion
 //#region src/db/migrator.ts
@@ -27828,7 +28096,8 @@ var init_admin_cluster_settings = __esmMin((() => {
 		checkRunTrackingTtlDays: "check_run_tracking_ttl_days",
 		concurrencyWaitTimeoutMs: "concurrency_wait_timeout_ms",
 		agentTokenTtlMs: "agent_token_ttl_ms",
-		ownershipDbCheckTimeoutMs: "ownership_db_check_timeout_ms"
+		ownershipDbCheckTimeoutMs: "ownership_db_check_timeout_ms",
+		unroutableGraceMs: "unroutable_grace_ms"
 	};
 	STRING_COLUMNS = { dashboardVerifiedIssuer: "dashboard_verified_issuer" };
 	updateSchema$1 = z.object({
@@ -27850,6 +28119,8 @@ var init_admin_cluster_settings = __esmMin((() => {
 		concurrencyWaitTimeoutMs: z.number().int().min(1e3).nullable().optional(),
 		agentTokenTtlMs: z.number().int().min(1e3).nullable().optional(),
 		ownershipDbCheckTimeoutMs: z.number().int().min(100).nullable().optional(),
+		/** 0 disables unroutable fast-fail, so the floor is 0, not 1000. */
+		unroutableGraceMs: z.number().int().min(0).nullable().optional(),
 		/**
 		* Verified-tier origin for browser-sealed dashboard writes. Must be an
 		* absolute http(s) origin (the dashboard fetches `<issuer>/.well-known/jwks.json`
@@ -29521,6 +29792,8 @@ function createAdminRoutes(deps) {
 			const resolved = await routeScope(scope);
 			const scopeError = validateScopeName(resolved.path);
 			if (scopeError) return c.json({ error: scopeError }, 400);
+			const keyError = validateSecretKey(key);
+			if (keyError) return c.json({ error: keyError }, 400);
 			await resolved.store.setSecret(orgId, resolved.path, key, parsed.value);
 			await deps.auditLogger.log({
 				action: "setSecret",
@@ -32078,6 +32351,23 @@ function mapRunDetailStep(step) {
 		...step.group_id != null && { groupId: step.group_id }
 	};
 }
+/**
+* The routing reason as a reader should see it.
+*
+* `routing_reason` is only meaningful while the job is still waiting to be
+* routed, and more than twenty call sites move a job out of `pending`/`queued`
+* — dispatch, cancel, the run-level failure cascades, the stale detector.
+* Requiring every one of them to also null the column would be fragile in the
+* one direction that matters: the site somebody forgets renders a finished job
+* as "waiting for an agent".
+*
+* So the guard lives here, at the read boundary both projections share, where
+* it cannot be forgotten by a writer that does not know this column exists.
+* The stale bytes may linger in the row; they are never shown.
+*/
+function visibleRoutingReason(status, routingReason) {
+	return status === ExecutionJobStatus.enum.pending || status === ExecutionJobStatus.enum.queued ? routingReason ?? null : null;
+}
 /** Map queried job + step rows into the dashboard run-detail job DTO shape. */
 function buildRunDetailJobs(jobs, lookups) {
 	const { stepsByJob, secretKeysByJob, needsByJob } = lookups;
@@ -32098,6 +32388,7 @@ function buildRunDetailJobs(jobs, lookups) {
 			agentId: job.agent_id ?? null,
 			orchestratorId: null,
 			errorMessage: job.error_message ?? null,
+			routingReason: visibleRoutingReason(job.status, job.routing_reason ?? null),
 			runsOnLabels: job.runs_on_labels ?? null,
 			contexts: job.contexts ? typeof job.contexts === "string" ? JSON.parse(job.contexts) : job.contexts : null,
 			skippedContexts: job.skipped_contexts ? typeof job.skipped_contexts === "string" ? JSON.parse(job.skipped_contexts) : job.skipped_contexts : null,
@@ -32671,6 +32962,7 @@ function createAdminRunRoutes(deps) {
 				"completed_at",
 				"duration_ms",
 				"error_message",
+				"routing_reason",
 				"runs_on_labels",
 				"created_at"
 			]).where("run_id", "=", runId).orderBy("created_at", "asc").execute();
@@ -32724,6 +33016,7 @@ function createAdminRunRoutes(deps) {
 					completedAt: job.completed_at?.toISOString() ?? null,
 					durationMs: job.duration_ms,
 					errorMessage: job.error_message,
+					routingReason: visibleRoutingReason(job.status, job.routing_reason),
 					runsOnLabels: safeJsonParse$1(job.runs_on_labels),
 					createdAt: job.created_at.toISOString(),
 					needs: needsByJob.get(job.job_name) ?? null
@@ -34124,15 +34417,15 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.2.0",
-			buildDate: "2026-08-08T03:42:24.121Z",
-			buildCommit: "15d5e4447",
-			sdkVersion: "0.2.0",
+			version: "0.4.0",
+			buildDate: "2026-08-09T15:20:50.779Z",
+			buildCommit: "ffd489464",
+			sdkVersion: "0.4.0",
 			sdkBundleHash: "fcd0a836aa1cb92debd93e0254450614d123b3748511aa4148d956fd72a7c29f",
-			sharedVersion: "0.2.0",
+			sharedVersion: "0.4.0",
 			sharedBundleHash: "f16fa528a8a9ef1bed8df369f0e88efafca8a9954a749005299fdbcdb93fa188",
-			engineVersion: "0.2.0",
-			engineBundleHash: "c579e54f7d0b0d5b16587a0528a3e66d32f63e2434bb471a93a01366296efd58"
+			engineVersion: "0.4.0",
+			engineBundleHash: "31e2d5c327284e1cac908d7f85cf6d878bbf87ea0da93ed09c6205ada6935f89"
 		}),
 		readinessCheck: deps.db ? async () => {
 			const checks = {};
@@ -34167,7 +34460,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.2.0",
+			orchestratorVersion: "0.4.0",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -36786,7 +37079,7 @@ var init_app = __esmMin((() => {
 	init_log_chunk_sink();
 	init_agent_metrics_aggregator();
 	logger$57 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.2.0";
+	ORCHESTRATOR_VERSION$2 = "0.4.0";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -43700,7 +43993,8 @@ var init_execution_tracker = __esmMin((() => {
 			await this.db.updateTable("execution_jobs").set({
 				status: ExecutionJobStatus.enum.failed,
 				completed_at: now,
-				error_message: failureReason
+				error_message: failureReason,
+				routing_reason: null
 			}).where("run_id", "=", runId).where("status", "in", [ExecutionJobStatus.enum.pending, ExecutionJobStatus.enum.queued]).execute();
 			await this.jobQueue?.failByRunId(runId);
 			const run = this.runs.get(runId);
@@ -43952,7 +44246,8 @@ var init_execution_tracker = __esmMin((() => {
 			await this.db.updateTable("execution_jobs").set({
 				status: ExecutionJobStatus.enum.failed,
 				completed_at: now,
-				error_message: reason
+				error_message: reason,
+				routing_reason: null
 			}).where("run_id", "=", runId).where("status", "in", [ExecutionJobStatus.enum.pending, ExecutionJobStatus.enum.queued]).execute();
 			await this.jobQueue?.failByRunId(runId);
 			executionsTotal.add(1, { status: ExecutionRunStatus.enum.failed });
@@ -45976,7 +46271,7 @@ var logger$44, SOFTWARE_VERSION$1, PeerClient$1;
 var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	logger$44 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.2.0";
+	SOFTWARE_VERSION$1 = "0.4.0";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -47939,7 +48234,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$42 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.2.0";
+	SOFTWARE_VERSION = "0.4.0";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -55968,6 +56263,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		logger$24.warn("cold-store singleton init skipped", { error: toErrorMessage(err) });
 	}
 	accessLogWriter.setColdStore(coldStoreSingleton);
+	const canRouteLabels = (labels, patterns, excludeLabels, excludePatterns) => agentRegistry.hasMatchingAgent(labels, patterns, excludeLabels, excludePatterns) || (scalerManager?.hasBackendForLabels(labels, excludeLabels) ?? false);
 	const scheduledJobHandles = bootstrapOrchestratorScheduledJobs({
 		db,
 		instanceId: config.instanceId
@@ -55985,7 +56281,26 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 				clusterSettings,
 				logStorage,
 				logStorageIsS3: config.storage?.type === "s3",
-				canRouteLabels: (labels, patterns, excludeLabels, excludePatterns) => agentRegistry.hasMatchingAgent(labels, patterns, excludeLabels, excludePatterns) || (scalerManager?.hasBackendForLabels(labels, excludeLabels) ?? false)
+				canRouteLabels
+			})
+		},
+		unroutableProbe: {
+			intervalMs: probeTickIntervalMs(config.unroutableGraceMs > 0 ? config.unroutableGraceMs : DEFAULT_UNROUTABLE_GRACE_MS),
+			handler: createUnroutableProbeHandler({
+				queue,
+				getGraceMs: () => clusterSettings.getNumber("unroutable_grace_ms", config.unroutableGraceMs),
+				canRouteLabels,
+				setRoutingReason: makeRoutingReasonWriter(db),
+				terminalize: async (job) => {
+					await terminalizeUnroutableJob({
+						db,
+						executionTracker,
+						checkRunReporter,
+						canRouteLabels
+					}, job);
+					await executionTracker.completeRunIfAllJobsTerminal(job.runId);
+				},
+				onFastFailed: () => unroutableFastFailedTotal.add(1)
 			})
 		},
 		orphanSecretCleanup: {
@@ -56973,6 +57288,9 @@ var init_orchestrator_core = __esmMin((() => {
 	init_host_roster_reaper();
 	init_job_queue();
 	init_cleanup$1();
+	init_terminalize_unroutable();
+	init_unroutable_probe();
+	init_prometheus();
 	init_bootstrap();
 	init_orchestrator_cold_store();
 	init_depth_refresher();
@@ -56985,7 +57303,6 @@ var init_orchestrator_core = __esmMin((() => {
 	init_dedup();
 	init_observer_registry();
 	init_agent_heartbeat();
-	init_prometheus();
 	init_ingest_admission();
 	init_loop_lag_source();
 	init_org_ingest_cap_reader();
@@ -64584,6 +64901,12 @@ var init_config = __esmMin((() => {
 		queueMaxDepth: z.coerce.number().default(1e3),
 		queueTimeoutMs: z.coerce.number().default(36e5),
 		/**
+		* Grace a job may stay continuously unroutable (nothing in the fleet matches
+		* its selectors) before it is terminalized. Cluster default; the live value
+		* is the `unroutable_grace_ms` cluster setting. 0 = fast-fail disabled.
+		*/
+		unroutableGraceMs: z.coerce.number().default(12e4),
+		/**
 		* Operator-facing backpressure warning threshold for the dispatch queue.
 		* When pending-queue depth stays at or above this value for at least two
 		* consecutive refresher ticks (~10s), the orchestrator emits a
@@ -64861,6 +65184,7 @@ var init_config = __esmMin((() => {
 			lockfileCacheMaxBytes: "KICI_LOCKFILE_CACHE_MAX_BYTES",
 			queueMaxDepth: "KICI_QUEUE_MAX_DEPTH",
 			queueTimeoutMs: "KICI_QUEUE_TIMEOUT_MS",
+			unroutableGraceMs: "KICI_UNROUTABLE_GRACE_MS",
 			queueBackpressureThreshold: "KICI_QUEUE_BACKPRESSURE_THRESHOLD",
 			workerConcurrency: "KICI_WORKER_CONCURRENCY",
 			concurrencyWaitTimeoutMs: "KICI_CONCURRENCY_WAIT_TIMEOUT_MS",
@@ -67237,6 +67561,7 @@ var init_handler = __esmMin((() => {
 					"completed_at",
 					"duration_ms",
 					"error_message",
+					"routing_reason",
 					"runs_on_labels",
 					"contexts",
 					"skipped_contexts",
@@ -69248,6 +69573,7 @@ var init_handler = __esmMin((() => {
 				completed_at: coerceToDate(r.completed_at),
 				duration_ms: typeof r.duration_ms === "number" ? r.duration_ms : null,
 				error_message: typeof r.error_message === "string" ? r.error_message : null,
+				routing_reason: typeof r.routing_reason === "string" ? r.routing_reason : null,
 				runs_on_labels: typeof r.runs_on_labels === "string" ? r.runs_on_labels : null,
 				contexts: typeof r.contexts === "string" ? r.contexts : null,
 				skipped_contexts: typeof r.skipped_contexts === "string" ? r.skipped_contexts : null,
@@ -70248,6 +70574,7 @@ var init_dashboard_context_handler = __esmMin((() => {
 			try {
 				const { store, scope } = await this.resolveStoreForScope(msg.scope);
 				assertValidScopeName(scope);
+				assertValidSecretKey(msg.key);
 				await store.setSecret(this.deps.orgId, scope, msg.key, resolved.plaintext);
 				this.recordAccess(msg.actor, "secret.set", {
 					type: "secret_scope",
@@ -75285,14 +75612,14 @@ var init_worker_core = __esmMin((() => {
 	init_peer_outbox();
 	init_worker_outbox_relay();
 	init_app_on_error();
-	ORCHESTRATOR_VERSION$1 = "0.2.0";
-	WORKER_BUILD_COMMIT = "15d5e4447";
-	WORKER_SDK_VERSION = "0.2.0";
+	ORCHESTRATOR_VERSION$1 = "0.4.0";
+	WORKER_BUILD_COMMIT = "ffd489464";
+	WORKER_SDK_VERSION = "0.4.0";
 	WORKER_SDK_BUNDLE_HASH = "fcd0a836aa1cb92debd93e0254450614d123b3748511aa4148d956fd72a7c29f";
-	WORKER_SHARED_VERSION = "0.2.0";
+	WORKER_SHARED_VERSION = "0.4.0";
 	WORKER_SHARED_BUNDLE_HASH = "f16fa528a8a9ef1bed8df369f0e88efafca8a9954a749005299fdbcdb93fa188";
-	WORKER_ENGINE_VERSION = "0.2.0";
-	WORKER_ENGINE_BUNDLE_HASH = "c579e54f7d0b0d5b16587a0528a3e66d32f63e2434bb471a93a01366296efd58";
+	WORKER_ENGINE_VERSION = "0.4.0";
+	WORKER_ENGINE_BUNDLE_HASH = "31e2d5c327284e1cac908d7f85cf6d878bbf87ea0da93ed09c6205ada6935f89";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
 }));
@@ -75316,14 +75643,14 @@ var init_worker_core = __esmMin((() => {
 init_verify_inbound();
 init_ingest_overflow_types();
 init_scope_routing();
-const ORCHESTRATOR_VERSION = "0.2.0";
-const BUILD_COMMIT = "15d5e4447";
-const SDK_VERSION = "0.2.0";
+const ORCHESTRATOR_VERSION = "0.4.0";
+const BUILD_COMMIT = "ffd489464";
+const SDK_VERSION = "0.4.0";
 const SDK_BUNDLE_HASH = "fcd0a836aa1cb92debd93e0254450614d123b3748511aa4148d956fd72a7c29f";
-const SHARED_VERSION = "0.2.0";
+const SHARED_VERSION = "0.4.0";
 const SHARED_BUNDLE_HASH = "f16fa528a8a9ef1bed8df369f0e88efafca8a9954a749005299fdbcdb93fa188";
-const ENGINE_VERSION = "0.2.0";
-const ENGINE_BUNDLE_HASH = "c579e54f7d0b0d5b16587a0528a3e66d32f63e2434bb471a93a01366296efd58";
+const ENGINE_VERSION = "0.4.0";
+const ENGINE_BUNDLE_HASH = "31e2d5c327284e1cac908d7f85cf6d878bbf87ea0da93ed09c6205ada6935f89";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT