@kici-dev/orchestrator 0.20.0 → 0.21.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import fs, { chmodSync, closeSync, constants, createReadStream, createWriteStrea
 import { Command, Option } from "commander";
 import { AGENT_DEFAULT_PORT, LOGGER_ENV_VARS, ORCHESTRATOR_DEFAULT_PORT, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
 import { AgentPlatform, BaseColdStore, ChunkLru, PgTableAdapterBase, ReadinessStatus, addLogsToArchive, clearDispatchQueueDirect, computeMigrationsHash, createColdStoreAdminOps, createContextTemplateDirect, createDb, createDbRole, createLogger, createPool, createReadOnlyDbUser, createS3Client, decrypt, deleteContextDirect, deriveKey, diagnoseExitCode, diffFingerprints, dropAndCreateDatabase, emitKiciEventDirect, encrypt, ensureDatabase, fingerprintSchema, formatBytes, formatDiffEntry, formatUptime, isSchemaCurrent, kiciMkdtemp, listCheckRunTrackingDirect, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedContextBindingDirect, seedContextDirect, serializeError, setContextPolicyDirect, setContextSecretDirect, sha256, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, toCommandError, toErrorMessage } from "@kici-dev/shared";
-import { AccessLogSource, ApprovalDecision, CiTrustLevel, ContextType, ExecutionJobStatus, FleetHostWriteRefusal, ForkPolicy, HoldType, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MinimumTrustSchema, OrchRole, OrchestratorMode, PLATFORM_CONNECTED_MODES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PeerForgetOutcome, RuntimeFact, ScalerBackendType, ScalerEventType, ScalerReloadOutcome, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, agentLabelOf, assertValidSecretKey, attestationVerifyStatusSchema, canonicalizeLabel, canonicalizeLabels, canonicalizeMatcher, flattenActor, formatExpiryDuration, getAccessLogColdDays, getSecretAuditLogColdDays, joinResponseSchema, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseExpiryDuration, parseHostPropertyAssignments, platformToTaints, resolveHeldRunId, resolveRoleLabels, resourceRequestNestedSchema, runtimeLabel, scalerAgentLabels, scalerPlatformSchema, secretAuditLogWarmSqlCase, shouldRecordAccess, sleep, toIsoString } from "@kici-dev/engine";
+import { AccessLogSource, ApprovalDecision, CiTrustLevel, ContextType, ExecutionJobStatus, FleetHostWriteRefusal, ForkPolicy, HoldType, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MinimumTrustSchema, OrchRole, OrchestratorMode, PLATFORM_CONNECTED_MODES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PeerForgetOutcome, RuntimeFact, ScalerBackendType, ScalerEventType, ScalerReloadOutcome, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, StepPhase, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, agentLabelOf, assertValidSecretKey, attestationVerifyStatusSchema, canonicalizeLabel, canonicalizeLabels, canonicalizeMatcher, compareStepsByPhase, flattenActor, formatExpiryDuration, getAccessLogColdDays, getSecretAuditLogColdDays, initStepIndex, initStepLabel, initStepType, invalidRunIdMessage, joinResponseSchema, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseExpiryDuration, parseHostPropertyAssignments, parseInitStepRef, parseRunIdRef, pickRunIdMatch, platformToTaints, resolveHeldRunId, resolveRoleLabels, resourceRequestNestedSchema, runIdHasPrefix, runtimeLabel, scalerAgentLabels, scalerPlatformSchema, secretAuditLogWarmSqlCase, shouldRecordAccess, sleep, stepPhase, toIsoString } from "@kici-dev/engine";
 import crypto$1, { createDecipheriv, createHash, createHmac, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { createInterface } from "node:readline";
 import { access, chmod, constants as constants$1, copyFile, link, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
@@ -521,6 +521,7 @@ var AdminApiClient = class {
 			workflowName: opts?.workflowName,
 			repo: opts?.repo,
 			since: opts?.since,
+			runIdPrefix: opts?.runIdPrefix,
 			limit: opts?.limit || void 0,
 			offset: opts?.offset || void 0
 		});
@@ -1874,8 +1875,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$158,
-	up: () => up$158
+	down: () => down$159,
+	up: () => up$159
 });
 /**
 * Squashed initial migration: the complete Orchestrator baseline schema, replacing the original
@@ -2559,7 +2560,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$158(db) {
+async function up$159(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2578,7 +2579,7 @@ async function up$158(db) {
   `.execute(db);
 }
 /** Drops everything `up` created; CASCADE cuts the FK graph without a topological order. */
-async function down$158(db) {
+async function down$159(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2625,8 +2626,8 @@ async function down$158(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$157,
-	up: () => up$157
+	down: () => down$158,
+	up: () => up$158
 });
 /**
 * `config_versions.key_version`, so `kici-admin rotate-key` can rotate sensitive-field encryption.
@@ -2637,13 +2638,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 *
 * No index: rotation full-scans; reads go by the `version` primary key.
 */
-async function up$157(db) {
+async function up$158(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$157(db) {
+async function down$158(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2652,8 +2653,8 @@ async function down$157(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$156,
-	up: () => up$156
+	down: () => down$157,
+	up: () => up$157
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2672,7 +2673,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 *
 * Retention is TTL-based via expires_at; queue/cleanup.ts prunes.
 */
-async function up$156(db) {
+async function up$157(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2710,28 +2711,28 @@ async function up$156(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$156(db) {
+async function down$157(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$155,
-	up: () => up$155
+	down: () => down$156,
+	up: () => up$156
 });
-async function up$155(db) {
+async function up$156(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$155(db) {
+async function down$156(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$154,
-	up: () => up$154
+	down: () => down$155,
+	up: () => up$155
 });
 /**
 * Per-(db, table, tenant) archived-chunk totals, so the `cold_store_chunks_total` gauge and
@@ -2740,7 +2741,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 * Starts empty; the archiver upserts it in the same transaction as every successful chunk
 * write (`INSERT ... ON CONFLICT (db, table_name, tenant_id) DO UPDATE ...`).
 */
-async function up$154(db) {
+async function up$155(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2758,14 +2759,14 @@ async function up$154(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$154(db) {
+async function down$155(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$153,
-	up: () => up$153
+	down: () => down$154,
+	up: () => up$154
 });
 /**
 * Cold-store columns for `execution_runs` / `execution_jobs` / `execution_steps`.
@@ -2781,7 +2782,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 * The `(routing_key, created_at)` indexes serve the archiver's `listEligiblePartitions` query
 * (`GROUP BY routing_key, DATE(created_at)`).
 */
-async function up$153(db) {
+async function up$154(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2826,7 +2827,7 @@ async function up$153(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$153(db) {
+async function down$154(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2851,8 +2852,8 @@ async function down$153(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$152,
-	up: () => up$152
+	down: () => down$153,
+	up: () => up$153
 });
 /**
 * Cold-store columns for `secret_audit_log` and `access_log`, and removal of `access_log`'s
@@ -2870,7 +2871,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * contract. `down()` recreates it with a `now() + 90 days` default, best effort: rows inserted
 * after `up()` get no meaningful retention bound.
 */
-async function up$152(db) {
+async function up$153(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2891,7 +2892,7 @@ async function up$152(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$152(db) {
+async function down$153(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2919,8 +2920,8 @@ async function down$152(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$151,
-	up: () => up$151
+	down: () => down$152,
+	up: () => up$152
 });
 /**
 * `event_log` cold-store schema: adds the `archived_at` /
@@ -2941,7 +2942,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * effort; rows inserted between `up()` and `down()` get no meaningful
 * retention bound.
 */
-async function up$151(db) {
+async function up$152(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2957,7 +2958,7 @@ async function up$151(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$151(db) {
+async function down$152(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2976,8 +2977,8 @@ async function down$151(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$150,
-	up: () => up$150
+	down: () => down$151,
+	up: () => up$151
 });
 /**
 * pg_trgm index on access_log.error_message for the Activity page's `q` search; matches the
@@ -2986,7 +2987,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * Idempotent. No CONCURRENTLY because Kysely runs migrations inside a transaction; the lock is
 * brief on a sampled table.
 */
-async function up$150(db) {
+async function up$151(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2995,14 +2996,14 @@ async function up$150(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$150(db) {
+async function down$151(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$149,
-	up: () => up$149
+	down: () => down$150,
+	up: () => up$150
 });
 /**
 * Cold-store chunk index: one row per archived chunk the GC sweep can later
@@ -3024,7 +3025,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * V1-manifest chunks are NOT here — they live forever — nor are chunks from
 * adapters that do not opt into per-bucket archival via `coldTtlDays`.
 */
-async function up$149(db) {
+async function up$150(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -3051,14 +3052,14 @@ async function up$149(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$149(db) {
+async function down$150(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$148,
-	up: () => up$148
+	down: () => down$149,
+	up: () => up$149
 });
 /**
 * Drops `source_secrets_change_trigger` and `notify_source_secrets_change()`. Their only
@@ -3069,11 +3070,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * `down` re-creates both as defined in `001_initial.ts`; they wake no consumer, so the
 * rollback is safe.
 */
-async function up$148(db) {
+async function up$149(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$148(db) {
+async function down$149(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3112,8 +3113,8 @@ async function down$148(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$147,
-	up: () => up$147
+	down: () => down$148,
+	up: () => up$148
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -3132,7 +3133,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (revoked rows
 * cannot be safely recreated, and the dedupe is monotonic).
 */
-async function up$147(db) {
+async function up$148(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -3150,14 +3151,14 @@ async function up$147(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$147(db) {
+async function down$148(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$146,
-	up: () => up$146
+	down: () => down$147,
+	up: () => up$147
 });
 /**
 * Per-run and per-job raw log byte totals, reported by agents on terminal `step.status`.
@@ -3168,7 +3169,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 * Default 0 needs no backfill: older runs never had the agent telemetry, so zero is correct.
 * Idempotent.
 */
-async function up$146(db) {
+async function up$147(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -3178,15 +3179,15 @@ async function up$146(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$146(db) {
+async function down$147(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$145,
-	up: () => up$145
+	down: () => down$146,
+	up: () => up$146
 });
 /**
 * Lease + retry + DLQ columns on `kici_events`, so the EventRouter delivers
@@ -3207,7 +3208,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Partial indexes skip the hot-path processed=true rows. Idempotent.
 */
-async function up$145(db) {
+async function up$146(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3238,7 +3239,7 @@ async function up$145(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$145(db) {
+async function down$146(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3256,8 +3257,8 @@ async function down$145(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$144,
-	up: () => up$144
+	down: () => down$145,
+	up: () => up$145
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3280,7 +3281,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: an existing `customer_id` column makes a re-run a no-op.
 */
-async function up$144(db) {
+async function up$145(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3405,7 +3406,7 @@ async function up$144(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$144(db) {
+async function down$145(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3430,8 +3431,8 @@ async function down$144(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$143,
-	up: () => up$143
+	down: () => down$144,
+	up: () => up$144
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3442,7 +3443,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent.
 */
-async function up$143(db) {
+async function up$144(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3456,7 +3457,7 @@ async function up$143(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$143(db) {
+async function down$144(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3464,8 +3465,8 @@ async function down$143(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$142,
-	up: () => up$142
+	down: () => down$143,
+	up: () => up$143
 });
 /**
 * Widen orchestrator `org_id varchar(12)` columns to `varchar(16)` for the Platform's prefixed
@@ -3488,17 +3489,17 @@ const ORG_ID_TABLES$3 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$142(db) {
+async function up$143(db) {
 	for (const table of ORG_ID_TABLES$3) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$142(db) {
+async function down$143(db) {
 	for (const table of ORG_ID_TABLES$3) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$141,
-	up: () => up$141
+	down: () => down$142,
+	up: () => up$142
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3534,19 +3535,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$141(db) {
+async function up$142(db) {
 	for (const table of ORG_ID_TABLES$2) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$141(db) {
+async function down$142(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES$2) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$140,
-	up: () => up$140
+	down: () => down$141,
+	up: () => up$141
 });
 /**
 * Add a trigger on `generic_webhook_sources` that emits
@@ -3565,7 +3566,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * Mirrors the GitHub-app `sources` trigger (`notify_sources_change()` +
 * `sources_change_trigger` in `001_initial.ts`).
 */
-async function up$140(db) {
+async function up$141(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3586,15 +3587,15 @@ async function up$140(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$140(db) {
+async function down$141(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$139,
-	up: () => up$139
+	down: () => down$140,
+	up: () => up$140
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3606,7 +3607,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent.
 */
-async function up$139(db) {
+async function up$140(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3620,7 +3621,7 @@ async function up$139(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$139(db) {
+async function down$140(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3628,8 +3629,8 @@ async function down$139(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$138,
-	up: () => up$138
+	down: () => down$139,
+	up: () => up$139
 });
 /**
 * `check_run_tracking`: `CheckRunReporter` state keyed per (provider, owner, repo, sha,
@@ -3641,7 +3642,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$138(db) {
+async function up$139(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3672,14 +3673,14 @@ async function up$138(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$138(db) {
+async function down$139(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$137,
-	up: () => up$137
+	down: () => down$138,
+	up: () => up$138
 });
 /**
 * Persists `ScalerManager` per-coord state:
@@ -3696,7 +3697,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: an existing table is left alone.
 */
-async function up$137(db) {
+async function up$138(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3746,7 +3747,7 @@ async function up$137(db) {
     `.execute(db);
 	}
 }
-async function down$137(db) {
+async function down$138(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3754,8 +3755,8 @@ async function down$137(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$136,
-	up: () => up$136
+	down: () => down$137,
+	up: () => up$137
 });
 /**
 * Persists per-job agent-disconnect recovery state, so a coord crash between starting the
@@ -3768,7 +3769,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 *
 * Idempotent: an existing column is a no-op.
 */
-async function up$136(db) {
+async function up$137(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3793,7 +3794,7 @@ async function up$136(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$136(db) {
+async function down$137(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3805,8 +3806,8 @@ async function down$136(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$135,
-	up: () => up$135
+	down: () => down$136,
+	up: () => up$136
 });
 /**
 * `dispatch_queue.last_provisioning_error`: the latest scaler spawn-failure detail for a queued
@@ -3816,7 +3817,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: an existing column is a no-op.
 */
-async function up$135(db) {
+async function up$136(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3832,7 +3833,7 @@ async function up$135(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$135(db) {
+async function down$136(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -3840,8 +3841,8 @@ async function down$135(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$134,
-	up: () => up$134
+	down: () => down$135,
+	up: () => up$135
 });
 /**
 * `init_failure` on `execution_runs` / `execution_jobs`: non-NULL means the run/job never
@@ -3851,7 +3852,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent per column.
 */
-async function up$134(db) {
+async function up$135(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3871,7 +3872,7 @@ async function up$134(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$134(db) {
+async function down$135(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -3882,8 +3883,8 @@ async function down$134(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$133,
-	up: () => up$133
+	down: () => down$134,
+	up: () => up$134
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -3892,7 +3893,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$133(db) {
+async function up$134(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3902,7 +3903,7 @@ async function up$133(db) {
     ])))
   `.execute(db);
 }
-async function down$133(db) {
+async function down$134(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3915,8 +3916,8 @@ async function down$133(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$132,
-	up: () => up$132
+	down: () => down$133,
+	up: () => up$133
 });
 /**
 * Add `execution_runs.workflow_timeout_ms`: the lock workflow's wall-clock timeout (ms), read at
@@ -3926,13 +3927,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 * INTEGER like the other `*_ms` columns, so pg reads a plain number rather than a BIGINT string;
 * it caps the timeout at ~24.8 days. Idempotent.
 */
-async function up$132(db) {
+async function up$133(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$132(db) {
+async function down$133(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -3940,8 +3941,8 @@ async function down$132(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$131,
-	up: () => up$131
+	down: () => down$132,
+	up: () => up$132
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -3967,7 +3968,7 @@ async function columnExists$16(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$131(db) {
+async function up$132(db) {
 	if (!await columnExists$16(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -3977,7 +3978,7 @@ async function up$131(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$131(db) {
+async function down$132(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -3988,8 +3989,8 @@ async function down$131(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$130,
-	up: () => up$130
+	down: () => down$131,
+	up: () => up$131
 });
 /**
 * Add `dispatch_queue.dispatch_attempts`: how often a job returned to `pending` after a failed
@@ -3997,7 +3998,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 * fails the job at MAX_DISPATCH_ATTEMPTS, bounding requeue loops; `expires_at` stays the
 * time-based backstop. Idempotent.
 */
-async function up$130(db) {
+async function up$131(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4010,7 +4011,7 @@ async function up$130(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$130(db) {
+async function down$131(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -4018,8 +4019,8 @@ async function down$130(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$129,
-	up: () => up$129
+	down: () => down$130,
+	up: () => up$130
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL, so
@@ -4029,14 +4030,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: both drops are no-ops on a re-run, and the constraint is
 * re-created with the SET NULL action.
 */
-async function up$129(db) {
+async function up$130(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$129(db) {
+async function down$130(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -4046,8 +4047,8 @@ async function down$129(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$128,
-	up: () => up$128
+	down: () => down$129,
+	up: () => up$129
 });
 /**
 * Add `dispatch_queue.ack_deadline` / `ack_agent_id`: the persisted per-dispatch ack deadline
@@ -4058,7 +4059,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 * the leader-gated `Dispatcher.sweepExpiredAckDeadlines` when that coord crashed;
 * `Dispatcher.recoverState()` re-arms timers on coord boot. Idempotent.
 */
-async function up$128(db) {
+async function up$129(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4083,7 +4084,7 @@ async function up$128(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$128(db) {
+async function down$129(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4091,8 +4092,8 @@ async function down$128(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$127,
-	up: () => up$127
+	down: () => down$128,
+	up: () => up$128
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4104,7 +4105,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$127(db) {
+async function up$128(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4118,7 +4119,7 @@ async function up$127(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$127(db) {
+async function down$128(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4126,8 +4127,8 @@ async function down$127(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$126,
-	up: () => up$126
+	down: () => down$127,
+	up: () => up$127
 });
 /**
 * Add the approval-policy columns to `org_settings`:
@@ -4141,7 +4142,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * Set per org via `kici-admin org-settings approval` and the orchestrator admin
 * route. Idempotent: each column is guarded independently.
 */
-async function up$126(db) {
+async function up$127(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4161,7 +4162,7 @@ async function up$126(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$126(db) {
+async function down$127(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -4172,8 +4173,8 @@ async function down$126(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$125,
-	up: () => up$125
+	down: () => down$126,
+	up: () => up$126
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the "held element" model behind
@@ -4187,7 +4188,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * - `approval_requirement` — the normalized `ApprovalRequirement` (clauses + expiresAt +
 *   reason); NULL on rows that predate the approval model.
 */
-async function up$125(db) {
+async function up$126(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4220,7 +4221,7 @@ async function up$125(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$125(db) {
+async function down$126(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -4230,8 +4231,8 @@ async function down$125(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$124,
-	up: () => up$124
+	down: () => down$125,
+	up: () => up$125
 });
 /**
 * Pending workflow dispatch context, for resuming a workflow whose install gate
@@ -4239,7 +4240,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * WorkflowDispatchContext when the hold releases (reviewer approve, wait-timer
 * expiry, free concurrency slot); it is deleted once the resume dispatch starts.
 */
-async function up$124(db) {
+async function up$125(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -4249,14 +4250,14 @@ async function up$124(db) {
     )
   `.execute(db);
 }
-async function down$124(db) {
+async function down$125(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$123,
-	up: () => up$123
+	down: () => down$124,
+	up: () => up$124
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -4269,7 +4270,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$123(db) {
+async function up$124(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4295,14 +4296,14 @@ async function up$123(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$123(db) {
+async function down$124(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$122,
-	up: () => up$122
+	down: () => down$123,
+	up: () => up$123
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -4318,7 +4319,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$122(db) {
+async function up$123(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4334,7 +4335,7 @@ async function up$122(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$122(db) {
+async function down$123(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4353,8 +4354,8 @@ async function down$122(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$121,
-	up: () => up$121
+	down: () => down$122,
+	up: () => up$122
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real org: one row per
@@ -4364,7 +4365,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: an existing table is a no-op.
 */
-async function up$121(db) {
+async function up$122(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4383,14 +4384,14 @@ async function up$121(db) {
     )
   `.execute(db);
 }
-async function down$121(db) {
+async function down$122(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$120,
-	up: () => up$120
+	down: () => down$121,
+	up: () => up$121
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -4407,7 +4408,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$120(db) {
+async function up$121(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4437,14 +4438,14 @@ async function up$120(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$120(db) {
+async function down$121(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$119,
-	up: () => up$119
+	down: () => down$120,
+	up: () => up$120
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -4468,7 +4469,7 @@ async function colExists$22(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$119(db) {
+async function up$120(db) {
 	if (!await colExists$22(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
 	if (!await colExists$22(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
 	if (!await colExists$22(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
@@ -4479,7 +4480,7 @@ async function up$119(db) {
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$119(db) {
+async function down$120(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -4489,8 +4490,8 @@ async function down$119(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$118,
-	up: () => up$118
+	down: () => down$119,
+	up: () => up$119
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -4519,7 +4520,7 @@ async function colExists$21(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$118(db) {
+async function up$119(db) {
 	if (!await colExists$21(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
 	if (!await colExists$21(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
 	if (!await colExists$21(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
@@ -4528,7 +4529,7 @@ async function up$118(db) {
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$118(db) {
+async function down$119(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -4537,8 +4538,8 @@ async function down$118(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$117,
-	up: () => up$117
+	down: () => down$118,
+	up: () => up$118
 });
 /**
 * Add dispatch_queue `runs_on_patterns` (regex matchers the agent's labels must satisfy) and
@@ -4557,19 +4558,19 @@ async function colExists$20(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$117(db) {
+async function up$118(db) {
 	if (!await colExists$20(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 	if (!await colExists$20(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$117(db) {
+async function down$118(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$116,
-	up: () => up$116
+	down: () => down$117,
+	up: () => up$117
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -4590,17 +4591,17 @@ async function colExists$19(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$116(db) {
+async function up$117(db) {
 	if (!await colExists$19(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$116(db) {
+async function down$117(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$115,
-	up: () => up$115
+	down: () => down$116,
+	up: () => up$116
 });
 /**
 * Add the check-mode columns, all nullable. Idempotent.
@@ -4622,13 +4623,13 @@ async function colExists$18(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$115(db) {
+async function up$116(db) {
 	if (!await colExists$18(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
 	if (!await colExists$18(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
 	if (!await colExists$18(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
 	if (!await colExists$18(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$115(db) {
+async function down$116(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -4637,8 +4638,8 @@ async function down$115(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$114,
-	up: () => up$114
+	down: () => down$115,
+	up: () => up$115
 });
 /**
 * `host_roster.host_properties jsonb NOT NULL DEFAULT '{}'`: the typed host-vars
@@ -4648,18 +4649,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent and additive.
 */
-async function up$114(db) {
+async function up$115(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$114(db) {
+async function down$115(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$113,
-	up: () => up$113
+	down: () => down$114,
+	up: () => up$114
 });
 /**
 * `join_tokens.consumed_by_instance`: the joining peer's `instanceId` at first consumption
@@ -4669,18 +4670,18 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * credential self-heals by re-presenting the join token in its env, with no operator action.
 * Idempotent and additive.
 */
-async function up$113(db) {
+async function up$114(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$113(db) {
+async function down$114(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$112,
-	up: () => up$112
+	down: () => down$113,
+	up: () => up$113
 });
 /**
 * Migrate `execution_job_needs` from the binary `if_failed` policy to a
@@ -4714,7 +4715,7 @@ async function colExists$17(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
-async function up$112(db) {
+async function up$113(db) {
 	if (!await colExists$17(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
@@ -4733,7 +4734,7 @@ async function up$112(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$112(db) {
+async function down$113(db) {
 	if (!await colExists$17(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
@@ -4749,8 +4750,8 @@ async function down$112(db) {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$111,
-	up: () => up$111
+	down: () => down$112,
+	up: () => up$112
 });
 /**
 * `host_roster.reboot_pending_until`: the persisted reboot-pending flag (NULL = none), set when
@@ -4761,36 +4762,36 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * rebooting box, and (3) clears on the next reconnect, releasing the held job.
 * Idempotent and additive.
 */
-async function up$111(db) {
+async function up$112(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$111(db) {
+async function down$112(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$110,
-	up: () => up$110
+	down: () => down$111,
+	up: () => up$111
 });
 /**
 * Add `held_runs.payload`: the `{ summaryMarkdown, drift }` captured when a `when: 'drift'`
 * step-approval gate fires, so the dashboard approval queue and the CLI render the diff the
 * operator approves. NULL for every non-drift hold. Idempotent and additive.
 */
-async function up$110(db) {
+async function up$111(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$110(db) {
+async function down$111(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$109,
-	up: () => up$109
+	down: () => down$110,
+	up: () => up$110
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -4804,18 +4805,18 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
 * preserved.
 */
-async function up$109(db) {
+async function up$110(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down$109(db) {
+async function down$110(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/051_binding_host_pattern.ts
 var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$108,
-	up: () => up$108
+	down: () => down$109,
+	up: () => up$109
 });
 /**
 * Per-host environment secret bindings:
@@ -4828,7 +4829,7 @@ var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent and additive.
 */
-async function up$108(db) {
+async function up$109(db) {
 	await sql`ALTER TABLE public.environment_bindings
     ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
@@ -4836,7 +4837,7 @@ async function up$108(db) {
 	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
     ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
 }
-async function down$108(db) {
+async function down$109(db) {
 	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
     DROP COLUMN IF EXISTS host_pattern`.execute(db);
@@ -4846,8 +4847,8 @@ async function down$108(db) {
 //#endregion
 //#region src/db/migrations/052_host_reach_metadata.ts
 var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$107,
-	up: () => up$107
+	down: () => down$108,
+	up: () => up$108
 });
 /**
 * Add SSH reach metadata so a declared host with no agent yet can be bootstrapped:
@@ -4861,14 +4862,14 @@ var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
 * All nullable: a host without them cannot be bootstrapped and is otherwise unaffected.
 * Idempotent and additive.
 */
-async function up$107(db) {
+async function up$108(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS address text,
     ADD COLUMN IF NOT EXISTS ssh_user text,
     ADD COLUMN IF NOT EXISTS ssh_port integer,
     ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
 }
-async function down$107(db) {
+async function down$108(db) {
 	await sql`ALTER TABLE public.host_roster
     DROP COLUMN IF EXISTS address,
     DROP COLUMN IF EXISTS ssh_user,
@@ -4878,8 +4879,8 @@ async function down$107(db) {
 //#endregion
 //#region src/db/migrations/053_agent_token_single_use.ts
 var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$106,
-	up: () => up$106
+	down: () => down$107,
+	up: () => up$107
 });
 /**
 * `agent_tokens.consumed_at timestamptz NULL`: the single-use marker for the
@@ -4890,19 +4891,19 @@ var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent and additive.
 */
-async function up$106(db) {
+async function up$107(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
 }
-async function down$106(db) {
+async function down$107(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS consumed_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/054_local_working_tree.ts
 var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$105,
-	up: () => up$105
+	down: () => down$106,
+	up: () => up$106
 });
 /**
 * Add `execution_runs.local_working_tree boolean NOT NULL DEFAULT false`: true
@@ -4913,19 +4914,19 @@ var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so existing
 * data is preserved.
 */
-async function up$105(db) {
+async function up$106(db) {
 	await sql`ALTER TABLE public.execution_runs
     ADD COLUMN IF NOT EXISTS local_working_tree boolean NOT NULL DEFAULT false`.execute(db);
 }
-async function down$105(db) {
+async function down$106(db) {
 	await sql`ALTER TABLE public.execution_runs
     DROP COLUMN IF EXISTS local_working_tree`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/055_agent_token_mandatory_labels.ts
 var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$104,
-	up: () => up$104
+	down: () => down$105,
+	up: () => up$105
 });
 /**
 * `agent_tokens.mandatory_labels text NULL`: a JSON-encoded `string[]` of
@@ -4936,19 +4937,19 @@ var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent and additive.
 */
-async function up$104(db) {
+async function up$105(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS mandatory_labels text`.execute(db);
 }
-async function down$104(db) {
+async function down$105(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS mandatory_labels`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/056_execution_jobs_environments.ts
 var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$103,
-	up: () => up$103
+	down: () => down$104,
+	up: () => up$104
 });
 /**
 * Add `execution_jobs.environments`: a JSON-encoded `string[]` of the environment names a job
@@ -4956,19 +4957,19 @@ var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
 * `(dynamic)` placeholder), then overwritten with the full list when a deferred-init agent eval
 * resolves them. NULL = no environment. Idempotent and additive.
 */
-async function up$103(db) {
+async function up$104(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS environments text`.execute(db);
 }
-async function down$103(db) {
+async function down$104(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS environments`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/057_step_concurrency.ts
 var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$102,
-	up: () => up$102
+	down: () => down$103,
+	up: () => up$103
 });
 /**
 * Add parallel step-group concurrency columns to `execution_steps`:
@@ -4991,19 +4992,19 @@ async function colExists$16(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$102(db) {
+async function up$103(db) {
 	if (!await colExists$16(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
 	if (!await colExists$16(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
 }
-async function down$102(db) {
+async function down$103(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/058_access_log_agent_label.ts
 var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$101,
-	up: () => up$101
+	down: () => down$102,
+	up: () => up$102
 });
 /**
 * Add `access_log.agent_label text` — the human-set name of the agent that
@@ -5023,17 +5024,17 @@ async function colExists$15(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$101(db) {
+async function up$102(db) {
 	if (!await colExists$15(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
 }
-async function down$101(db) {
+async function down$102(db) {
 	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/059_attestation_verdict.ts
 var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$100,
-	up: () => up$100
+	down: () => down$101,
+	up: () => up$101
 });
 /**
 * Add server-side verification verdict columns to `attestations`, plus the
@@ -5060,7 +5061,7 @@ async function colExists$14(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$100(db) {
+async function up$101(db) {
 	if (await colExists$14(db, "attestations", "verify_status")) return;
 	await sql`
     ALTER TABLE public.attestations
@@ -5073,7 +5074,7 @@ async function up$100(db) {
 	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
 	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
 }
-async function down$100(db) {
+async function down$101(db) {
 	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
@@ -5088,8 +5089,8 @@ async function down$100(db) {
 //#endregion
 //#region src/db/migrations/060_run_trigger_actor.ts
 var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$99,
-	up: () => up$99
+	down: () => down$100,
+	up: () => up$100
 });
 /**
 * Triggering-actor columns on `execution_runs`:
@@ -5115,12 +5116,12 @@ async function colExists$13(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$99(db) {
+async function up$100(db) {
 	if (!await colExists$13(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
 	if (!await colExists$13(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
 	if (!await colExists$13(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
 }
-async function down$99(db) {
+async function down$100(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
@@ -5128,8 +5129,8 @@ async function down$99(db) {
 //#endregion
 //#region src/db/migrations/061_execution_runs_environment_id.ts
 var _061_execution_runs_environment_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$98,
-	up: () => up$98
+	down: () => down$99,
+	up: () => up$99
 });
 /**
 * `execution_runs.environment_id`, so environment run-history keys off the matched
@@ -5157,7 +5158,7 @@ async function colExists$12(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$98(db) {
+async function up$99(db) {
 	if (!await colExists$12(db, "execution_runs", "environment_id")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN environment_id uuid
@@ -5179,15 +5180,15 @@ async function up$98(db) {
              WHERE e2.type = 'fixed' AND e2.name = er.environment) = 1
   `.execute(db);
 }
-async function down$98(db) {
+async function down$99(db) {
 	await sql`DROP INDEX IF EXISTS idx_execution_runs_environment_id`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS environment_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/062_execution_runs_agent_label.ts
 var _062_execution_runs_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$97,
-	up: () => up$97
+	down: () => down$98,
+	up: () => up$98
 });
 /**
 * Agent provenance on `execution_runs`: `triggered_by_agent_label` / `cancelled_by_agent_label`
@@ -5207,19 +5208,19 @@ async function colExists$11(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$97(db) {
+async function up$98(db) {
 	if (!await colExists$11(db, "execution_runs", "triggered_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN triggered_by_agent_label text`.execute(db);
 	if (!await colExists$11(db, "execution_runs", "cancelled_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN cancelled_by_agent_label text`.execute(db);
 }
-async function down$97(db) {
+async function down$98(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS triggered_by_agent_label`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelled_by_agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/063_access_log_agent_label_index.ts
 var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$96,
-	up: () => up$96
+	down: () => down$97,
+	up: () => up$97
 });
 /**
 * Index `access_log.agent_label` (column added by migration 058) so the
@@ -5227,17 +5228,17 @@ var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
 * the dashboard "agent name" filter) does an indexed exact-match lookup
 * instead of a scan. Idempotent.
 */
-async function up$96(db) {
+async function up$97(db) {
 	await sql`CREATE INDEX IF NOT EXISTS access_log_agent_label_idx ON public.access_log (agent_label)`.execute(db);
 }
-async function down$96(db) {
+async function down$97(db) {
 	await sql`DROP INDEX IF EXISTS access_log_agent_label_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/064_execution_jobs_skipped_environments.ts
 var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$95,
-	up: () => up$95
+	down: () => down$96,
+	up: () => up$96
 });
 /**
 * Test-run skipped environments on `execution_jobs`:
@@ -5249,13 +5250,13 @@ var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent and additive.
 */
-async function up$95(db) {
+async function up$96(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS skipped_environments text`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS env_warning text`.execute(db);
 }
-async function down$95(db) {
+async function down$96(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS skipped_environments`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
@@ -5264,8 +5265,8 @@ async function down$95(db) {
 //#endregion
 //#region src/db/migrations/065_pending_attestations.ts
 var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$94,
-	up: () => up$94
+	down: () => down$95,
+	up: () => up$95
 });
 /**
 * The `pending_attestations` deferred-attestation outbox, plus an idempotency unique index on
@@ -5282,7 +5283,7 @@ var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$94(db) {
+async function up$95(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5321,15 +5322,15 @@ async function up$94(db) {
       ON public.attestations (run_id, job_id, subject_digest)
   `.execute(db);
 }
-async function down$94(db) {
+async function down$95(db) {
 	await sql`DROP INDEX IF EXISTS uq_attestations_run_job_subject`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.pending_attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/066_pending_attestations_rejected.ts
 var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$93,
-	up: () => up$93
+	down: () => down$94,
+	up: () => up$94
 });
 /**
 * Add `pending_attestations.rejected_at`: marks a deferred attestation the Platform definitively
@@ -5337,14 +5338,14 @@ var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
 * pending-attestations gauge; `kici-admin attestations retry --include-rejected` re-arms it.
 * Idempotent.
 */
-async function up$93(db) {
+async function up$94(db) {
 	if (await columnExists$15(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
       ADD COLUMN rejected_at TIMESTAMPTZ
   `.execute(db);
 }
-async function down$93(db) {
+async function down$94(db) {
 	if (!await columnExists$15(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
@@ -5362,8 +5363,8 @@ async function columnExists$15(db, table, column) {
 //#endregion
 //#region src/db/migrations/067_environments_to_contexts.ts
 var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$92,
-	up: () => up$92
+	down: () => down$93,
+	up: () => up$93
 });
 /**
 * Rename the named-policy object from "environment" to "context" across the
@@ -5397,7 +5398,7 @@ var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
 * columns automatically (Postgres references them by identity, not name), so
 * only the one hand-named index above needs an explicit rename.
 */
-async function up$92(db) {
+async function up$93(db) {
 	await sql`ALTER TABLE public.environments RENAME TO contexts`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings RENAME TO context_bindings`.execute(db);
 	await sql`ALTER TABLE public.environment_variables RENAME TO context_variables`.execute(db);
@@ -5416,7 +5417,7 @@ async function up$92(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'context'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'context'`.execute(db);
 }
-async function down$92(db) {
+async function down$93(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'environment'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'environment'`.execute(db);
 	await sql`UPDATE public.held_runs SET trigger_source = 'environment' WHERE trigger_source = 'context'`.execute(db);
@@ -5438,8 +5439,8 @@ async function down$92(db) {
 //#endregion
 //#region src/db/migrations/068_request_idempotency.ts
 var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$91,
-	up: () => up$91
+	down: () => down$92,
+	up: () => up$92
 });
 /**
 * Add the `request_idempotency` claim table, making run-minting dashboard
@@ -5452,12 +5453,12 @@ var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$91(db) {
+async function up$92(db) {
 	if (await tableExists$5(db, "request_idempotency")) return;
 	await db.schema.createTable("request_idempotency").addColumn("request_id", "text", (c) => c.primaryKey()).addColumn("new_run_id", "text", (c) => c.notNull()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("idx_request_idempotency_created_at").on("request_idempotency").column("created_at").execute();
 }
-async function down$91(db) {
+async function down$92(db) {
 	await db.schema.dropTable("request_idempotency").ifExists().execute();
 }
 async function tableExists$5(db, table) {
@@ -5471,8 +5472,8 @@ async function tableExists$5(db, table) {
 //#endregion
 //#region src/db/migrations/069_reroute_tunables.ts
 var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$90,
-	up: () => up$90
+	down: () => down$91,
+	up: () => up$91
 });
 /**
 * Add the per-org reroute tunables to `org_settings` (nullable; NULL is the cluster default; set
@@ -5483,12 +5484,12 @@ var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
 * - `reroute_ack_timeout_ms` — the reroute `sendAndWaitAck` deadline (`rerouteAckTimeoutMs`, 15s).
 * - `reroute_max_hops` — max peer hops for a rerouted job (`rerouteMaxHops`, 3).
 */
-async function up$90(db) {
+async function up$91(db) {
 	await addColumnIfMissing$1(db, "reroute_spawn_window_ms", "BIGINT");
 	await addColumnIfMissing$1(db, "reroute_ack_timeout_ms", "BIGINT");
 	await addColumnIfMissing$1(db, "reroute_max_hops", "INTEGER");
 }
-async function down$90(db) {
+async function down$91(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_spawn_window_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_ack_timeout_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_max_hops`.execute(db);
@@ -5507,8 +5508,8 @@ async function addColumnIfMissing$1(db, column, type) {
 //#endregion
 //#region src/db/migrations/070_execution_runs_failure_class.ts
 var _070_execution_runs_failure_class_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$89,
-	up: () => up$89
+	down: () => down$90,
+	up: () => up$90
 });
 /**
 * `execution_runs.failure_class` (`RunFailureClass`: never_started / timed_out /
@@ -5527,17 +5528,17 @@ async function colExists$10(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$89(db) {
+async function up$90(db) {
 	if (!await colExists$10(db, "execution_runs", "failure_class")) await sql`ALTER TABLE public.execution_runs ADD COLUMN failure_class text`.execute(db);
 }
-async function down$89(db) {
+async function down$90(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS failure_class`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/071_batch_accumulation.ts
 var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$88,
-	up: () => up$88
+	down: () => down$89,
+	up: () => up$89
 });
 /**
 * Batch-accumulation tables behind the `workflows_failed_batch` trigger.
@@ -5553,7 +5554,7 @@ var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$88(db) {
+async function up$89(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5598,35 +5599,35 @@ async function up$88(db) {
       ON public.batch_accumulation_items (window_id)
   `.execute(db);
 }
-async function down$88(db) {
+async function down$89(db) {
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_items`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_windows`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/072_dispatch_queue_run_id_index.ts
 var _072_dispatch_queue_run_id_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$87,
-	up: () => up$87
+	down: () => down$88,
+	up: () => up$88
 });
 /**
 * `failByRunId`, `cancelByRunId` and `getDispatchedJobIdsByRunId` filter on `run_id`; without
 * this index each run-failure cascade and cancel full-scans the dispatch history while holding
 * a pooled connection. `pruneTerminalDispatchRows` also uses it. Idempotent.
 */
-async function up$87(db) {
+async function up$88(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_run_id
       ON public.dispatch_queue (run_id)
   `.execute(db);
 }
-async function down$87(db) {
+async function down$88(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_run_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/073_org_settings_ingest_concurrency.ts
 var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$86,
-	up: () => up$86
+	down: () => down$87,
+	up: () => up$87
 });
 /**
 * Add `org_settings.ingest_max_concurrency BIGINT` (nullable).
@@ -5637,7 +5638,7 @@ var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$86(db) {
+async function up$87(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5651,7 +5652,7 @@ async function up$86(db) {
       ADD COLUMN ingest_max_concurrency BIGINT
   `.execute(db);
 }
-async function down$86(db) {
+async function down$87(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS ingest_max_concurrency
   `.execute(db);
@@ -5659,8 +5660,8 @@ async function down$86(db) {
 //#endregion
 //#region src/db/migrations/074_normalize_zero_concurrency_limit.ts
 var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$85,
-	up: () => up$85
+	down: () => down$86,
+	up: () => up$86
 });
 /**
 * Normalize non-positive `concurrency_limit` values, which wedge the workflow-install gate in
@@ -5668,15 +5669,15 @@ var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll(
 * integer. The write boundary rejects them and the gate treats them as unlimited.
 * Idempotent; down() is a no-op.
 */
-async function up$85(db) {
+async function up$86(db) {
 	await sql`UPDATE public.contexts SET concurrency_limit = NULL WHERE concurrency_limit <= 0`.execute(db);
 }
-async function down$85(_db) {}
+async function down$86(_db) {}
 //#endregion
 //#region src/db/migrations/075_ingest_overflow_buffer.ts
 var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$84,
-	up: () => up$84
+	down: () => down$85,
+	up: () => up$85
 });
 /**
 * Durable overflow buffer for shed webhook-ingest deliveries.
@@ -5690,7 +5691,7 @@ var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$84(db) {
+async function up$85(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5723,14 +5724,14 @@ async function up$84(db) {
       ON public.ingest_overflow_buffer (delivery_id)
   `.execute(db);
 }
-async function down$84(db) {
+async function down$85(db) {
 	await sql`DROP TABLE IF EXISTS public.ingest_overflow_buffer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/076_artifacts.ts
 var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$83,
-	up: () => up$83
+	down: () => down$84,
+	up: () => up$84
 });
 /**
 * Add the `artifacts` table for user-facing build artifacts and the per-org
@@ -5746,7 +5747,7 @@ var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent.
 */
-async function up$83(db) {
+async function up$84(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5782,7 +5783,7 @@ async function up$83(db) {
       ADD COLUMN IF NOT EXISTS artifact_ttl_ms BIGINT
   `.execute(db);
 }
-async function down$83(db) {
+async function down$84(db) {
 	await sql`DROP TABLE IF EXISTS public.artifacts`.execute(db);
 	await sql`
     ALTER TABLE public.org_settings
@@ -5793,8 +5794,8 @@ async function down$83(db) {
 //#endregion
 //#region src/db/migrations/077_backup_runs.ts
 var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$82,
-	up: () => up$82
+	down: () => down$83,
+	up: () => up$83
 });
 /**
 * Add the `backup_runs` table: one row per successful `kici-admin db backup`,
@@ -5805,12 +5806,12 @@ var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$82(db) {
+async function up$83(db) {
 	if (await tableExists$4(db, "backup_runs")) return;
 	await db.schema.createTable("backup_runs").addColumn("id", "bigserial", (c) => c.primaryKey()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("dump_path", "text", (c) => c.notNull()).addColumn("byte_size", "bigint", (c) => c.notNull()).addColumn("secret_key_version", "integer").addColumn("pg_server_version", "text", (c) => c.notNull()).addColumn("migrations_hash", "text", (c) => c.notNull()).addColumn("hostname", "text", (c) => c.notNull()).execute();
 	await db.schema.createIndex("idx_backup_runs_created_at").on("backup_runs").column("created_at").execute();
 }
-async function down$82(db) {
+async function down$83(db) {
 	await db.schema.dropTable("backup_runs").ifExists().execute();
 }
 async function tableExists$4(db, table) {
@@ -5824,15 +5825,15 @@ async function tableExists$4(db, table) {
 //#endregion
 //#region src/db/migrations/078_org_settings_backup_staleness.ts
 var _078_org_settings_backup_staleness_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$81,
-	up: () => up$81
+	down: () => down$82,
+	up: () => up$82
 });
 /**
 * Add `org_settings.backup_staleness_warn_hours`: the per-org WARN threshold for the DB-backup
 * freshness diagnostic, set via `kici-admin org-settings backup-freshness`. NULL is the cluster
 * default (`config.backupStalenessWarnHours`, 24h). Idempotent.
 */
-async function up$81(db) {
+async function up$82(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5846,7 +5847,7 @@ async function up$81(db) {
       ADD COLUMN backup_staleness_warn_hours INTEGER
   `.execute(db);
 }
-async function down$81(db) {
+async function down$82(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS backup_staleness_warn_hours
   `.execute(db);
@@ -5854,8 +5855,8 @@ async function down$81(db) {
 //#endregion
 //#region src/db/migrations/079_org_settings_scaler_spawn_timeout.ts
 var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$80,
-	up: () => up$80
+	down: () => down$81,
+	up: () => up$81
 });
 /**
 * `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable): per-org deadline
@@ -5863,7 +5864,7 @@ var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll
 * falls back to `KICI_SCALER_SPAWN_TIMEOUT_MS` (default 300s). Tuned per tenant
 * via `kici-admin org-settings scaler-spawn-timeout`. Idempotent.
 */
-async function up$80(db) {
+async function up$81(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5877,7 +5878,7 @@ async function up$80(db) {
       ADD COLUMN scaler_spawn_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$80(db) {
+async function down$81(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS scaler_spawn_timeout_ms
   `.execute(db);
@@ -5885,8 +5886,8 @@ async function down$80(db) {
 //#endregion
 //#region src/db/migrations/080_cluster_settings.ts
 var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$79,
-	up: () => up$79
+	down: () => down$80,
+	up: () => up$80
 });
 /**
 * Create `cluster_settings`: a single-row (id='default') table of fleet-wide operator tunables;
@@ -5897,7 +5898,7 @@ var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
 * Read via ClusterSettingsReader (whole-row, short-TTL cache); written via
 * `/api/v1/admin/cluster-settings` and `kici-admin cluster-settings`. Idempotent.
 */
-async function up$79(db) {
+async function up$80(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5921,14 +5922,14 @@ async function up$79(db) {
     )
   `.execute(db);
 }
-async function down$79(db) {
+async function down$80(db) {
 	await sql`DROP TABLE IF EXISTS public.cluster_settings`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/081_org_settings_queue_timeout.ts
 var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$78,
-	up: () => up$78
+	down: () => down$79,
+	up: () => up$79
 });
 /**
 * `org_settings.queue_timeout_ms BIGINT` (nullable): per-org dispatch-queue job
@@ -5941,7 +5942,7 @@ var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
 * `cacheOrgId` in scope; fleet-wide tunables live on `cluster_settings`
 * (migration 080). Idempotent.
 */
-async function up$78(db) {
+async function up$79(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5955,7 +5956,7 @@ async function up$78(db) {
       ADD COLUMN queue_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$78(db) {
+async function down$79(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS queue_timeout_ms
   `.execute(db);
@@ -5963,8 +5964,8 @@ async function down$78(db) {
 //#endregion
 //#region src/db/migrations/082_host_s3_reachable.ts
 var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$77,
-	up: () => up$77
+	down: () => down$78,
+	up: () => up$78
 });
 /**
 * Add `host_roster.s3_reachable`, a fresh-box bring-up delivery hint set via
@@ -5973,7 +5974,7 @@ var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
 * through the ops agent). NULL / false: the `ssh-push` fallback (the ops agent fetches the
 * payload and scp's it to the box). Idempotent.
 */
-async function up$77(db) {
+async function up$78(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5987,7 +5988,7 @@ async function up$77(db) {
       ADD COLUMN s3_reachable BOOLEAN
   `.execute(db);
 }
-async function down$77(db) {
+async function down$78(db) {
 	await sql`
     ALTER TABLE public.host_roster DROP COLUMN IF EXISTS s3_reachable
   `.execute(db);
@@ -5995,8 +5996,8 @@ async function down$77(db) {
 //#endregion
 //#region src/db/migrations/083_org_settings_artifact_caps.ts
 var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$76,
-	up: () => up$76
+	down: () => down$77,
+	up: () => up$77
 });
 /**
 * Add `org_settings.artifact_max_bytes` + `artifact_max_per_run` (both nullable
@@ -6010,7 +6011,7 @@ var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$76(db) {
+async function up$77(db) {
 	for (const col of ["artifact_max_bytes", "artifact_max_per_run"]) {
 		if ((await sql`
       SELECT EXISTS (
@@ -6023,15 +6024,15 @@ async function up$76(db) {
 		await sql`ALTER TABLE public.org_settings ADD COLUMN ${sql.ref(col)} BIGINT`.execute(db);
 	}
 }
-async function down$76(db) {
+async function down$77(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_bytes`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_per_run`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/084_orchestrator_signing_keys.ts
 var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$75,
-	up: () => up$75
+	down: () => down$76,
+	up: () => up$76
 });
 /**
 * Add `orchestrator_signing_keys`: the cluster-scoped, long-lived ES256 keys that sign the
@@ -6044,12 +6045,12 @@ var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
 * `scoped_secrets`), NULL for `aws-kms` / `command` custody where the private key never lives in
 * the DB; `key_ref` then locates the external key (KMS ARN / signer command). Idempotent.
 */
-async function up$75(db) {
+async function up$76(db) {
 	if (await tableExists$3(db, "orchestrator_signing_keys")) return;
 	await db.schema.createTable("orchestrator_signing_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_jwk", "text").addColumn("key_version", "integer", (c) => c.notNull().defaultTo(1)).addColumn("alg", "text", (c) => c.notNull()).addColumn("signer_kind", "text", (c) => c.notNull()).addColumn("key_ref", "text").addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("retired_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_orch_signing_keys_status").on("orchestrator_signing_keys").column("status").execute();
 }
-async function down$75(db) {
+async function down$76(db) {
 	await db.schema.dropTable("orchestrator_signing_keys").ifExists().execute();
 }
 async function tableExists$3(db, table) {
@@ -6063,8 +6064,8 @@ async function tableExists$3(db, table) {
 //#endregion
 //#region src/db/migrations/085_cluster_settings_reroute_flap_grace_ms.ts
 var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$74,
-	up: () => up$74
+	down: () => down$75,
+	up: () => up$75
 });
 /**
 * Fleet-wide grace window (ms) in which the recovery sweepers defer a rerouted job while its
@@ -6073,7 +6074,7 @@ var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __expo
 *
 * Idempotent: guarded on column existence.
 */
-async function up$74(db) {
+async function up$75(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6084,14 +6085,14 @@ async function up$74(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN reroute_flap_grace_ms BIGINT`.execute(db);
 }
-async function down$74(db) {
+async function down$75(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS reroute_flap_grace_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/086_cluster_settings_max_fanout_hosts.ts
 var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$73,
-	up: () => up$73
+	down: () => down$74,
+	up: () => up$74
 });
 /**
 * Add `cluster_settings.max_fanout_hosts` (nullable INTEGER).
@@ -6101,7 +6102,7 @@ var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: guarded on column existence.
 */
-async function up$73(db) {
+async function up$74(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6112,14 +6113,14 @@ async function up$73(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN max_fanout_hosts INTEGER`.execute(db);
 }
-async function down$73(db) {
+async function down$74(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS max_fanout_hosts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/087_cluster_settings_event_router_rate_limit.ts
 var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$72,
-	up: () => up$72
+	down: () => down$73,
+	up: () => up$73
 });
 /**
 * Add `cluster_settings.event_router_rate_limit_per_workflow_per_minute` (nullable INTEGER).
@@ -6131,7 +6132,7 @@ var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __ex
 *
 * Idempotent: guarded on column existence.
 */
-async function up$72(db) {
+async function up$73(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6142,14 +6143,14 @@ async function up$72(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN event_router_rate_limit_per_workflow_per_minute INTEGER`.execute(db);
 }
-async function down$72(db) {
+async function down$73(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS event_router_rate_limit_per_workflow_per_minute`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/088_cluster_settings_cache_max_tarball_bytes.ts
 var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$71,
-	up: () => up$71
+	down: () => down$72,
+	up: () => up$72
 });
 /**
 * Add `cluster_settings.cache_max_tarball_bytes` (nullable BIGINT).
@@ -6159,7 +6160,7 @@ var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __ex
 *
 * Idempotent: guarded on column existence.
 */
-async function up$71(db) {
+async function up$72(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6170,14 +6171,14 @@ async function up$71(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_max_tarball_bytes BIGINT`.execute(db);
 }
-async function down$71(db) {
+async function down$72(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_max_tarball_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/089_cluster_settings_cache_ttl_days.ts
 var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$70,
-	up: () => up$70
+	down: () => down$71,
+	up: () => up$71
 });
 /**
 * Fleet-wide dependency-cache entry TTL (days): an entry unread for longer expires on the next
@@ -6185,7 +6186,7 @@ var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$70(db) {
+async function up$71(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6196,21 +6197,21 @@ async function up$70(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_ttl_days INTEGER`.execute(db);
 }
-async function down$70(db) {
+async function down$71(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_ttl_days`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/090_cluster_settings_concurrency_wait_timeout_ms.ts
 var _090_cluster_settings_concurrency_wait_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$69,
-	up: () => up$69
+	down: () => down$70,
+	up: () => up$70
 });
 /**
 * Add `cluster_settings.concurrency_wait_timeout_ms`: the fleet-wide agent concurrency-slot wait
 * timeout (ms), pushed to the agent on `job.dispatch`. NULL is the cluster default
 * (`config.concurrencyWaitTimeoutMs`, `KICI_CONCURRENCY_WAIT_TIMEOUT_MS`). Idempotent.
 */
-async function up$69(db) {
+async function up$70(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6221,21 +6222,21 @@ async function up$69(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN concurrency_wait_timeout_ms BIGINT`.execute(db);
 }
-async function down$69(db) {
+async function down$70(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS concurrency_wait_timeout_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/091_cluster_settings_agent_token_ttl_ms.ts
 var _091_cluster_settings_agent_token_ttl_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$68,
-	up: () => up$68
+	down: () => down$69,
+	up: () => up$69
 });
 /**
 * `cluster_settings.agent_token_ttl_ms` (nullable BIGINT): fleet-wide ephemeral
 * agent-token TTL (ms), resolved by the leader at spawn. NULL → cluster default
 * (`config.agentTokenTtlMs`, `KICI_AGENT_TOKEN_TTL_MS`). Idempotent.
 */
-async function up$68(db) {
+async function up$69(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6246,14 +6247,14 @@ async function up$68(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN agent_token_ttl_ms BIGINT`.execute(db);
 }
-async function down$68(db) {
+async function down$69(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS agent_token_ttl_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/092_cluster_settings_version.ts
 var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$67,
-	up: () => up$67
+	down: () => down$68,
+	up: () => up$68
 });
 /**
 * `cluster_settings.version`, monotonic and bumped on each settings change. The leader
@@ -6263,7 +6264,7 @@ var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$67(db) {
+async function up$68(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6274,14 +6275,14 @@ async function up$67(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN version BIGINT NOT NULL DEFAULT 0`.execute(db);
 }
-async function down$67(db) {
+async function down$68(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS version`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/093_org_settings_sandbox_allowlist.ts
 var _093_org_settings_sandbox_allowlist_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$66,
-	up: () => up$66
+	down: () => down$67,
+	up: () => up$67
 });
 /**
 * Add the per-org container-sandbox escape-hatch allow-list to `org_settings`:
@@ -6308,7 +6309,7 @@ async function columnExists$14(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$66(db) {
+async function up$67(db) {
 	if (!await columnExists$14(db, "sandbox_allowed_capabilities")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN sandbox_allowed_capabilities TEXT[]
@@ -6318,7 +6319,7 @@ async function up$66(db) {
         ADD COLUMN sandbox_allow_host_network BOOLEAN
     `.execute(db);
 }
-async function down$66(db) {
+async function down$67(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS sandbox_allowed_capabilities
   `.execute(db);
@@ -6329,8 +6330,8 @@ async function down$66(db) {
 //#endregion
 //#region src/db/migrations/094_dashboard_encryption_keys.ts
 var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$65,
-	up: () => up$65
+	down: () => down$66,
+	up: () => up$66
 });
 /**
 * Add `dashboard_encryption_keys`: the cluster-scoped, long-lived X25519 keypair for
@@ -6344,12 +6345,12 @@ var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
 * `revoked` and leaves the JWKS, but its row stays so already-sealed envelopes decrypt.
 * Idempotent.
 */
-async function up$65(db) {
+async function up$66(db) {
 	if (await tableExists$2(db, "dashboard_encryption_keys")) return;
 	await db.schema.createTable("dashboard_encryption_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_key", "text", (c) => c.notNull()).addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_dashboard_encryption_keys_status").on("dashboard_encryption_keys").column("status").execute();
 }
-async function down$65(db) {
+async function down$66(db) {
 	await db.schema.dropTable("dashboard_encryption_keys").ifExists().execute();
 }
 async function tableExists$2(db, table) {
@@ -6363,8 +6364,8 @@ async function tableExists$2(db, table) {
 //#endregion
 //#region src/db/migrations/095_dashboard_write_policy_tristate.ts
 var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$64,
-	up: () => up$64
+	down: () => down$65,
+	up: () => up$65
 });
 /**
 * Migrate stored `org_settings.dashboard_write_policy` JSONB from the legacy
@@ -6378,7 +6379,7 @@ var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
 * Runtime reads also coerce booleans, so an un-migrated row is never mis-read;
 * this normalizes the at-rest shape to what the tri-state writer produces.
 */
-async function up$64(db) {
+async function up$65(db) {
 	await sql`
     UPDATE org_settings
        SET dashboard_write_policy = COALESCE(
@@ -6405,12 +6406,12 @@ async function up$64(db) {
        )
   `.execute(db);
 }
-async function down$64() {}
+async function down$65() {}
 //#endregion
 //#region src/db/migrations/096_multi_schedule_cron_last_fired.ts
 var _096_multi_schedule_cron_last_fired_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$63,
-	up: () => up$63
+	down: () => down$64,
+	up: () => up$64
 });
 /**
 * Keys cron last-fired per (registration, schedule), so a workflow with several schedule()
@@ -6443,7 +6444,7 @@ async function primaryKeyColumns(db) {
      ORDER BY a.attnum
   `.execute(db)).rows.map((row) => row.attname);
 }
-async function up$63(db) {
+async function up$64(db) {
 	if (!await columnExists$13(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired ADD COLUMN schedule_key text`.execute(db);
 	await sql`
     UPDATE public.cron_last_fired clf
@@ -6470,7 +6471,7 @@ async function up$63(db) {
     `.execute(db);
 	}
 }
-async function down$63(db) {
+async function down$64(db) {
 	await sql`
     DELETE FROM public.cron_last_fired a
       USING public.cron_last_fired b
@@ -6487,8 +6488,8 @@ async function down$63(db) {
 //#endregion
 //#region src/db/migrations/097_execution_runs_pr_number.ts
 var _097_execution_runs_pr_number_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$62,
-	up: () => up$62
+	down: () => down$63,
+	up: () => up$63
 });
 /**
 * `execution_runs.pr_number` lets `/kici approve|reject` scope hold selection to the comment's
@@ -6507,13 +6508,13 @@ async function columnExists$12(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$62(db) {
+async function up$63(db) {
 	if (!await columnExists$12(db, "pr_number")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN pr_number INTEGER
     `.execute(db);
 }
-async function down$62(db) {
+async function down$63(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS pr_number
   `.execute(db);
@@ -6521,8 +6522,8 @@ async function down$62(db) {
 //#endregion
 //#region src/db/migrations/098_execution_runs_customer_id.ts
 var _098_execution_runs_customer_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$61,
-	up: () => up$61
+	down: () => down$62,
+	up: () => up$62
 });
 /**
 * Denormalize the owning org onto `execution_runs` so the concurrency-gate
@@ -6550,7 +6551,7 @@ async function columnExists$11(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$61(db) {
+async function up$62(db) {
 	if (!await columnExists$11(db, "customer_id")) {
 		await sql`
       ALTER TABLE public.execution_runs
@@ -6574,7 +6575,7 @@ async function up$61(db) {
       ON public.execution_runs (customer_id, context)
   `.execute(db);
 }
-async function down$61(db) {
+async function down$62(db) {
 	await sql`DROP INDEX IF EXISTS execution_runs_customer_id_context_idx`.execute(db);
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS customer_id
@@ -6583,8 +6584,8 @@ async function down$61(db) {
 //#endregion
 //#region src/db/migrations/099_cluster_settings_dashboard_verified_issuer.ts
 var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$60,
-	up: () => up$60
+	down: () => down$61,
+	up: () => up$61
 });
 /**
 * Add `cluster_settings.dashboard_verified_issuer` (nullable text).
@@ -6600,7 +6601,7 @@ var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __
 *
 * Idempotent: guarded on column existence.
 */
-async function up$60(db) {
+async function up$61(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6611,14 +6612,14 @@ async function up$60(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN dashboard_verified_issuer TEXT`.execute(db);
 }
-async function down$60(db) {
+async function down$61(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS dashboard_verified_issuer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/100_held_runs_hold_type_vocabulary.ts
 var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$59,
-	up: () => up$59
+	down: () => down$60,
+	up: () => up$60
 });
 /**
 * Realign `held_runs.hold_type` onto the engine's `HoldType` vocabulary.
@@ -6635,7 +6636,7 @@ var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a second run matches no rows.
 */
-async function up$59(db) {
+async function up$60(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'reviewer' WHERE hold_type = 'approval'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'timer' WHERE hold_type = 'wait_timer'`.execute(db);
 }
@@ -6649,15 +6650,15 @@ async function up$59(db) {
 * `wait_timer` alone, so leaving those rows spelled `timer` would strand them
 * in the expire-and-fail path.
 */
-async function down$59(db) {
+async function down$60(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'approval' WHERE hold_type = 'reviewer'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'wait_timer' WHERE hold_type = 'timer'`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/101_contexts_hold_expiry_drop_default.ts
 var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$58,
-	up: () => up$58
+	down: () => down$59,
+	up: () => up$59
 });
 /**
 * Give the context hold expiry a single default, and retire the stored zeroes.
@@ -6674,7 +6675,7 @@ var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll
 * Idempotent: dropping an absent default is a no-op and the UPDATE matches no
 * rows on a second run.
 */
-async function up$58(db) {
+async function up$59(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds DROP DEFAULT`.execute(db);
 	await sql`UPDATE public.contexts SET hold_expiry_seconds = NULL WHERE hold_expiry_seconds = 0`.execute(db);
 }
@@ -6684,14 +6685,14 @@ async function up$58(db) {
 * Deliberately asymmetric: zeroed rows are NOT recreated. They now look like a
 * deliberate NULL, and a `0` would resume cancelling every hold on its context.
 */
-async function down$58(db) {
+async function down$59(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds SET DEFAULT 86400`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/102_dispatch_queue_agent_id.ts
 var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$57,
-	up: () => up$57
+	down: () => down$58,
+	up: () => up$58
 });
 /**
 * Add `dispatch_queue.agent_id` (nullable text).
@@ -6704,7 +6705,7 @@ var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
 * No backfill: older rows keep a NULL owner and resolve to "not owned", as before.
 * Idempotent: guarded on column existence.
 */
-async function up$57(db) {
+async function up$58(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6715,14 +6716,14 @@ async function up$57(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.dispatch_queue ADD COLUMN agent_id TEXT`.execute(db);
 }
-async function down$57(db) {
+async function down$58(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS agent_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/103_cluster_settings_ownership_db_check_timeout_ms.ts
 var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$56,
-	up: () => up$56
+	down: () => down$57,
+	up: () => up$57
 });
 /**
 * Deadline for one DB-backed agent-ownership lookup, which runs inbound on every job-scoped
@@ -6734,7 +6735,7 @@ var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ *
 *
 * Idempotent: guarded on column existence.
 */
-async function up$56(db) {
+async function up$57(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6745,14 +6746,14 @@ async function up$56(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN ownership_db_check_timeout_ms BIGINT`.execute(db);
 }
-async function down$56(db) {
+async function down$57(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ownership_db_check_timeout_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/104_check_run_terminal_sent.ts
 var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$55,
-	up: () => up$55
+	down: () => down$56,
+	up: () => up$56
 });
 /**
 * Add `check_run_tracking.terminal_sent_at`.
@@ -6766,7 +6767,7 @@ var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
 * this table (a tracking write must never break check-run reporting), so NULL means "no record
 * of sending it", not "never sent". Idempotent.
 */
-async function up$55(db) {
+async function up$56(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6777,14 +6778,14 @@ async function up$55(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.check_run_tracking ADD COLUMN terminal_sent_at TIMESTAMPTZ`.execute(db);
 }
-async function down$55(db) {
+async function down$56(db) {
 	await sql`ALTER TABLE public.check_run_tracking DROP COLUMN IF EXISTS terminal_sent_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/105_org_trust_policy.ts
 var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$54,
-	up: () => up$54
+	down: () => down$55,
+	up: () => up$55
 });
 /**
 * Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
@@ -6799,7 +6800,7 @@ var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
 */
-async function up$54(db) {
+async function up$55(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.org_trust_policy (
       customer_id                TEXT PRIMARY KEY,
@@ -6812,14 +6813,14 @@ async function up$54(db) {
     )
   `.execute(db);
 }
-async function down$54(db) {
+async function down$55(db) {
 	await sql`DROP TABLE IF EXISTS public.org_trust_policy`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.ts
 var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$53,
-	up: () => up$53
+	down: () => down$54,
+	up: () => up$54
 });
 /**
 * Add `cluster_settings.check_run_tracking_ttl_days`: the hourly cleanup sweep deletes
@@ -6827,7 +6828,7 @@ var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */
 * orchestrator's configured default. Cluster-global, not `org_settings`, because the sweep runs
 * fleet-wide with no tenant in scope at the read site. Idempotent.
 */
-async function up$53(db) {
+async function up$54(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6838,14 +6839,14 @@ async function up$53(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN check_run_tracking_ttl_days INTEGER`.execute(db);
 }
-async function down$53(db) {
+async function down$54(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS check_run_tracking_ttl_days`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/107_check_run_tracking_updated_at_index.ts
 var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$52,
-	up: () => up$52
+	down: () => down$53,
+	up: () => up$53
 });
 /**
 * Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
@@ -6860,20 +6861,20 @@ var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportA
 * Mirrors `idx_dispatch_queue_run_id` (072) and `idx_request_idempotency_created_at` (068), which
 * also index a TTL sweep's prune predicate. Idempotent (`IF NOT EXISTS`).
 */
-async function up$52(db) {
+async function up$53(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_check_run_tracking_updated_at
       ON public.check_run_tracking (updated_at)
   `.execute(db);
 }
-async function down$52(db) {
+async function down$53(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_check_run_tracking_updated_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/108_unroutable_fast_fail.ts
 var _108_unroutable_fast_fail_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$51,
-	up: () => up$51
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * Fast-fail support for jobs nothing in the fleet can run.
@@ -6904,12 +6905,12 @@ async function columnExists$10(db, table, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$51(db) {
+async function up$52(db) {
 	if (!await columnExists$10(db, "cluster_settings", "unroutable_grace_ms")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN unroutable_grace_ms INTEGER`.execute(db);
 	if (!await columnExists$10(db, "dispatch_queue", "unroutable_since")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN unroutable_since TIMESTAMPTZ`.execute(db);
 	if (!await columnExists$10(db, "execution_jobs", "routing_reason")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN routing_reason TEXT`.execute(db);
 }
-async function down$51(db) {
+async function down$52(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS routing_reason`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS unroutable_since`.execute(db);
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS unroutable_grace_ms`.execute(db);
@@ -6917,8 +6918,8 @@ async function down$51(db) {
 //#endregion
 //#region src/db/migrations/109_cluster_settings_cache_knobs.ts
 var _109_cluster_settings_cache_knobs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$50,
-	up: () => up$50
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Cluster-global tunables for the lock-file cache and the Tier-1 content-requirements cache.
@@ -6950,17 +6951,17 @@ const COLUMNS$7 = [
 	"content_cache_max_bytes",
 	"content_cache_ttl_ms"
 ];
-async function up$50(db) {
+async function up$51(db) {
 	for (const column of COLUMNS$7) if (!await columnExists$9(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$50(db) {
+async function down$51(db) {
 	for (const column of COLUMNS$7) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/110_cluster_settings_global_eval_knobs.ts
 var _110_cluster_settings_global_eval_knobs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Cluster-global tunables for the Tier-2 global eval round — the pre-run job
@@ -6993,17 +6994,17 @@ const COLUMNS$6 = [
 	"global_eval_candidate_timeout_ms",
 	"global_eval_cache_max"
 ];
-async function up$49(db) {
+async function up$50(db) {
 	for (const column of COLUMNS$6) if (!await columnExists$8(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$49(db) {
+async function down$50(db) {
 	for (const column of COLUMNS$6) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/111_cluster_settings_global_eval_wait.ts
 var _111_cluster_settings_global_eval_wait_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Cluster-global ceiling on how long webhook processing waits for a Tier-2
@@ -7027,17 +7028,17 @@ async function columnExists$7(db, table, column) {
   `.execute(db)).rows[0]?.exists === true;
 }
 const COLUMNS$5 = ["global_eval_wait_timeout_ms"];
-async function up$48(db) {
+async function up$49(db) {
 	for (const column of COLUMNS$5) if (!await columnExists$7(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$48(db) {
+async function down$49(db) {
 	for (const column of COLUMNS$5) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/112_execution_runs_workflow_repo.ts
 var _112_execution_runs_workflow_repo_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Record which repository DEFINED the workflow a run executed.
@@ -7067,13 +7068,13 @@ async function colExists$9(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$47(db) {
+async function up$48(db) {
 	if (!await colExists$9(db, "execution_runs", "workflow_repo_identifier")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN workflow_repo_identifier text
     `.execute(db);
 }
-async function down$47(db) {
+async function down$48(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_repo_identifier
   `.execute(db);
@@ -7081,8 +7082,8 @@ async function down$47(db) {
 //#endregion
 //#region src/db/migrations/113_execution_runs_workflow_repo_index.ts
 var _113_execution_runs_workflow_repo_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Add the partial index `idx_execution_runs_workflow_repo` on
@@ -7101,21 +7102,21 @@ var _113_execution_runs_workflow_repo_index_exports = /* @__PURE__ */ __exportAl
 *
 * Idempotent: `IF NOT EXISTS`.
 */
-async function up$46(db) {
+async function up$47(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_execution_runs_workflow_repo
       ON public.execution_runs (workflow_repo_identifier)
       WHERE workflow_repo_identifier IS NOT NULL
   `.execute(db);
 }
-async function down$46(db) {
+async function down$47(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_runs_workflow_repo`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/114_ingest_queue_claim.ts
 var _114_ingest_queue_claim_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * Claim bookkeeping for the durable ingest queue.
@@ -7140,13 +7141,13 @@ async function columnExists$6(db, table, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$45(db) {
+async function up$46(db) {
 	if (!await columnExists$6(db, "ingest_overflow_buffer", "claimed_at")) await sql`ALTER TABLE public.ingest_overflow_buffer ADD COLUMN claimed_at TIMESTAMPTZ`.execute(db);
 	if (!await columnExists$6(db, "cluster_settings", "ingest_overflow_claim_timeout_ms")) await sql`
       ALTER TABLE public.cluster_settings ADD COLUMN ingest_overflow_claim_timeout_ms INTEGER
     `.execute(db);
 }
-async function down$45(db) {
+async function down$46(db) {
 	await sql`
     ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ingest_overflow_claim_timeout_ms
   `.execute(db);
@@ -7157,8 +7158,8 @@ async function down$45(db) {
 //#endregion
 //#region src/db/migrations/115_global_workflows_cluster_switch.ts
 var _115_global_workflows_cluster_switch_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Moves the global-workflows master switch from `org_settings` to `cluster_settings`. Whether
@@ -7186,7 +7187,7 @@ async function columnExists$5(db, table, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$44(db) {
+async function up$45(db) {
 	if (!await columnExists$5(db, "cluster_settings", "global_workflows_enabled")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN global_workflows_enabled BOOLEAN`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS global_workflows_enabled`.execute(db);
 }
@@ -7194,7 +7195,7 @@ async function up$44(db) {
 * Restores the org column as NOT NULL DEFAULT false. The per-org values `up` dropped are
 * unrecoverable, so every org comes back at the opt-in default.
 */
-async function down$44(db) {
+async function down$45(db) {
 	if (!await columnExists$5(db, "org_settings", "global_workflows_enabled")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN global_workflows_enabled BOOLEAN NOT NULL DEFAULT false
@@ -7204,20 +7205,20 @@ async function down$44(db) {
 //#endregion
 //#region src/db/migrations/116_org_plan_headroom.ts
 var _116_org_plan_headroom_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$44,
+	up: () => up$44
 });
-async function up$43(db) {
+async function up$44(db) {
 	await db.schema.createTable("org_plan_headroom").ifNotExists().addColumn("id", "varchar(16)", (col) => col.primaryKey()).addColumn("max_worker_peers", "integer", (col) => col.notNull()).addColumn("org_limit", "integer", (col) => col.notNull()).addColumn("org_total", "integer", (col) => col.notNull()).addColumn("evict_excess", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("updated_at", sql`timestamptz`, (col) => col.notNull()).execute();
 }
-async function down$43(db) {
+async function down$44(db) {
 	await db.schema.dropTable("org_plan_headroom").ifExists().execute();
 }
 //#endregion
 //#region src/db/migrations/117_invoke_gate_proxy_jobs.ts
 var _117_invoke_gate_proxy_jobs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * An invoke gate summons the source repo's opt-in workflows and tracks each spawned run as a
@@ -7244,7 +7245,7 @@ async function colExists$8(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$42(db) {
+async function up$43(db) {
 	if (!await colExists$8(db, "execution_jobs", "job_kind")) await sql`
       ALTER TABLE public.execution_jobs
         ADD COLUMN job_kind text NOT NULL DEFAULT 'standard'
@@ -7262,7 +7263,7 @@ async function up$42(db) {
         ADD COLUMN summoned_by_proxy_job text
     `.execute(db);
 }
-async function down$42(db) {
+async function down$43(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS job_kind`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS summoned_run_id`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS summoned_by_run_id`.execute(db);
@@ -7271,8 +7272,8 @@ async function down$42(db) {
 //#endregion
 //#region src/db/migrations/118_invoke_gate_scheduling.ts
 var _118_invoke_gate_scheduling_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Scheduling columns for the invoke gate: the pieces the orchestrator needs to
@@ -7304,7 +7305,7 @@ async function colExists$7(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$41(db) {
+async function up$42(db) {
 	if (!await colExists$7(db, "execution_jobs", "timeout_ms")) await sql`
       ALTER TABLE public.execution_jobs
         ADD COLUMN timeout_ms integer
@@ -7318,7 +7319,7 @@ async function up$41(db) {
         ADD COLUMN invoke_config text
     `.execute(db);
 }
-async function down$41(db) {
+async function down$42(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS timeout_ms`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS chain_depth`.execute(db);
 	await sql`ALTER TABLE public.pending_job_contexts DROP COLUMN IF EXISTS invoke_config`.execute(db);
@@ -7326,8 +7327,8 @@ async function down$41(db) {
 //#endregion
 //#region src/db/migrations/119_scaler_ha_ownership.ts
 var _119_scaler_ha_ownership_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * HA ownership for event-scaler provisions.
@@ -7372,7 +7373,7 @@ const SPAWNING_COLUMNS = [
 	["roles", "JSONB"],
 	["backend_type", "TEXT"]
 ];
-async function up$40(db) {
+async function up$41(db) {
 	if (!await tableExists$1(db, "scaler_pending_claims")) {
 		await sql`
       CREATE TABLE public.scaler_pending_claims (
@@ -7418,7 +7419,7 @@ async function up$40(db) {
       ON public.scaler_reservations (owner_instance_id)
   `.execute(db);
 }
-async function down$40(db) {
+async function down$41(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_pending_claims`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_scaler_spawning_agents_scaler_name`.execute(db);
 	for (const [name] of SPAWNING_COLUMNS) await sql`
@@ -7431,8 +7432,8 @@ async function down$40(db) {
 //#endregion
 //#region src/db/migrations/120_cluster_settings_scaler_reaper.ts
 var _120_cluster_settings_scaler_reaper_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Cluster-global tunables for the leader-gated event-scaler provision reaper: additive, nullable
@@ -7466,17 +7467,17 @@ const COLUMNS$4 = [
 	"scaler_reap_reattempt_interval_ms",
 	"scaler_claim_retention_ms"
 ];
-async function up$39(db) {
+async function up$40(db) {
 	for (const column of COLUMNS$4) if (!await columnExists$4(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$39(db) {
+async function down$40(db) {
 	for (const column of COLUMNS$4) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/121_org_settings_allow_untrusted_dockerfile_builds.ts
 var _121_org_settings_allow_untrusted_dockerfile_builds_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Add `org_settings.allow_untrusted_dockerfile_builds boolean NOT NULL DEFAULT false`.
@@ -7492,7 +7493,7 @@ var _121_org_settings_allow_untrusted_dockerfile_builds_exports = /* @__PURE__ *
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$38(db) {
+async function up$39(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7506,7 +7507,7 @@ async function up$38(db) {
       ADD COLUMN allow_untrusted_dockerfile_builds boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$38(db) {
+async function down$39(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_untrusted_dockerfile_builds
   `.execute(db);
@@ -7514,8 +7515,8 @@ async function down$38(db) {
 //#endregion
 //#region src/db/migrations/122_host_roster_scaler_managed.ts
 var _122_host_roster_scaler_managed_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Add `host_roster.scaler_managed`: whether a scaler backend spawned the agent.
@@ -7531,7 +7532,7 @@ var _122_host_roster_scaler_managed_exports = /* @__PURE__ */ __exportAll({
 * DEFAULT false is load-bearing: a pre-existing row reads as not-scaler-managed, so an existing
 * fleet host stays a fan-out target without re-registering. Idempotent.
 */
-async function up$37(db) {
+async function up$38(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7545,7 +7546,7 @@ async function up$37(db) {
       ADD COLUMN scaler_managed boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$37(db) {
+async function down$38(db) {
 	await sql`
     ALTER TABLE public.host_roster DROP COLUMN IF EXISTS scaler_managed
   `.execute(db);
@@ -7553,8 +7554,8 @@ async function down$37(db) {
 //#endregion
 //#region src/db/migrations/123_workflow_registrations_default_branch.ts
 var _123_workflow_registrations_default_branch_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add `workflow_registrations.default_branch`.
@@ -7568,7 +7569,7 @@ var _123_workflow_registrations_default_branch_exports = /* @__PURE__ */ __expor
 * Dispatch reads NULL as "no branch" and the context branch gate rejects with its named cause; a
 * DEFAULT would invent a branch the registration never proved. Idempotent.
 */
-async function up$36(db) {
+async function up$37(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7582,7 +7583,7 @@ async function up$36(db) {
       ADD COLUMN default_branch text
   `.execute(db);
 }
-async function down$36(db) {
+async function down$37(db) {
 	await sql`
     ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS default_branch
   `.execute(db);
@@ -7590,8 +7591,8 @@ async function down$36(db) {
 //#endregion
 //#region src/db/migrations/124_cluster_settings_provision_backoff.ts
 var _124_cluster_settings_provision_backoff_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Cluster-global tunables for backing off a repeatedly failing external (event) scaler.
@@ -7627,17 +7628,17 @@ const COLUMNS$3 = [
 	"scaler_provision_backoff_max_ms",
 	"scaler_provision_max_consecutive_failures"
 ];
-async function up$35(db) {
+async function up$36(db) {
 	for (const column of COLUMNS$3) if (!await columnExists$3(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$35(db) {
+async function down$36(db) {
 	for (const column of COLUMNS$3) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/125_org_trust_directory.ts
 var _125_org_trust_directory_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Create `org_trust_directory`: the orchestrator's cache of the Platform-owned approval directory
@@ -7657,7 +7658,7 @@ var _125_org_trust_directory_exports = /* @__PURE__ */ __exportAll({
 * when a Platform is attached, so there is one writer and no counterpart to
 * `org_trust_policy.source`. Idempotent (IF NOT EXISTS).
 */
-async function up$34(db) {
+async function up$35(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.org_trust_directory (
       customer_id      TEXT PRIMARY KEY,
@@ -7668,14 +7669,14 @@ async function up$34(db) {
     )
   `.execute(db);
 }
-async function down$34(db) {
+async function down$35(db) {
 	await sql`DROP TABLE IF EXISTS public.org_trust_directory`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/126_held_runs_posted_pending_check.ts
 var _126_held_runs_posted_pending_check_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Add `held_runs.posted_pending_check boolean` — whether this hold's pending
@@ -7695,7 +7696,7 @@ var _126_held_runs_posted_pending_check_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent.
 */
-async function up$33(db) {
+async function up$34(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7709,7 +7710,7 @@ async function up$33(db) {
       ADD COLUMN posted_pending_check boolean
   `.execute(db);
 }
-async function down$33(db) {
+async function down$34(db) {
 	await sql`
     ALTER TABLE public.held_runs DROP COLUMN IF EXISTS posted_pending_check
   `.execute(db);
@@ -7717,8 +7718,8 @@ async function down$33(db) {
 //#endregion
 //#region src/db/migrations/127_org_trust_policy_approval_expiry_seconds.ts
 var _127_org_trust_policy_approval_expiry_seconds_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Add `org_trust_policy.approval_expiry_seconds` (nullable INTEGER).
@@ -7734,7 +7735,7 @@ var _127_org_trust_policy_approval_expiry_seconds_exports = /* @__PURE__ */ __ex
 *
 * Idempotent: guarded on column existence.
 */
-async function up$32(db) {
+async function up$33(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7745,14 +7746,14 @@ async function up$32(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.org_trust_policy ADD COLUMN approval_expiry_seconds INTEGER`.execute(db);
 }
-async function down$32(db) {
+async function down$33(db) {
 	await sql`ALTER TABLE public.org_trust_policy DROP COLUMN IF EXISTS approval_expiry_seconds`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/128_execution_runs_global_eval_round.ts
 var _128_execution_runs_global_eval_round_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Add `execution_runs.is_global_eval_round boolean NOT NULL DEFAULT false` —
@@ -7768,7 +7769,7 @@ var _128_execution_runs_global_eval_round_exports = /* @__PURE__ */ __exportAll(
 * `NOT NULL DEFAULT false`: every pre-existing row is an ordinary run, and no
 * third "unknown" answer exists for a null to carry. Idempotent.
 */
-async function up$31(db) {
+async function up$32(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7782,7 +7783,7 @@ async function up$31(db) {
       ADD COLUMN is_global_eval_round BOOLEAN NOT NULL DEFAULT FALSE
   `.execute(db);
 }
-async function down$31(db) {
+async function down$32(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS is_global_eval_round
   `.execute(db);
@@ -7790,8 +7791,8 @@ async function down$31(db) {
 //#endregion
 //#region src/db/migrations/129_execution_runs_dispatch_routing_key.ts
 var _129_execution_runs_dispatch_routing_key_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add `execution_runs.dispatch_routing_key TEXT NULL` — the source whose
@@ -7810,7 +7811,7 @@ var _129_execution_runs_dispatch_routing_key_exports = /* @__PURE__ */ __exportA
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$30(db) {
+async function up$31(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7824,7 +7825,7 @@ async function up$30(db) {
       ADD COLUMN dispatch_routing_key TEXT
   `.execute(db);
 }
-async function down$30(db) {
+async function down$31(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS dispatch_routing_key
   `.execute(db);
@@ -7832,8 +7833,8 @@ async function down$30(db) {
 //#endregion
 //#region src/db/migrations/130_scaler_provision_outcomes.ts
 var _130_scaler_provision_outcomes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Durable per-provision outcome, keyed by agent id.
@@ -7856,7 +7857,7 @@ var _130_scaler_provision_outcomes_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: each statement is IF NOT EXISTS, covering a database with the table but not the
 * index, which a table-existence probe would skip.
 */
-async function up$29(db) {
+async function up$30(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.scaler_provision_outcomes (
       agent_id          TEXT PRIMARY KEY,
@@ -7874,14 +7875,14 @@ async function up$29(db) {
       ON public.scaler_provision_outcomes (updated_at)
   `.execute(db);
 }
-async function down$29(db) {
+async function down$30(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_provision_outcomes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/131_execution_jobs_git_credentials.ts
 var _131_execution_jobs_git_credentials_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `execution_jobs.git_credentials`: the job lock entry's `gitCredentials` map, as server
@@ -7899,7 +7900,7 @@ var _131_execution_jobs_git_credentials_exports = /* @__PURE__ */ __exportAll({
 * dispatch loop, so NULL also covers "not written yet", which the relay resolves against the
 * job's dispatch record (`git/job-context.ts`). Idempotent.
 */
-async function up$28(db) {
+async function up$29(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7913,7 +7914,7 @@ async function up$28(db) {
       ADD COLUMN git_credentials JSONB
   `.execute(db);
 }
-async function down$28(db) {
+async function down$29(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS git_credentials
   `.execute(db);
@@ -7921,8 +7922,8 @@ async function down$28(db) {
 //#endregion
 //#region src/db/migrations/132_execution_runs_trigger_event.ts
 var _132_execution_runs_trigger_event_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add `execution_runs.trigger_event`: the event type that started the run (`push`, `pr:open`,
@@ -7933,7 +7934,7 @@ var _132_execution_runs_trigger_event_exports = /* @__PURE__ */ __exportAll({
 * in. An unknown trigger fails a `triggerTypeFilters` rule closed, withholding the credential.
 * Idempotent.
 */
-async function up$27(db) {
+async function up$28(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7947,7 +7948,7 @@ async function up$27(db) {
       ADD COLUMN trigger_event TEXT
   `.execute(db);
 }
-async function down$27(db) {
+async function down$28(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_event
   `.execute(db);
@@ -7955,8 +7956,8 @@ async function down$27(db) {
 //#endregion
 //#region src/db/migrations/133_dispatch_queue_source_tar_digest.ts
 var _133_dispatch_queue_source_tar_digest_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add `dispatch_queue.source_tar_digest TEXT NULL` — the SHA-256 of the source
@@ -7974,7 +7975,7 @@ var _133_dispatch_queue_source_tar_digest_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
 * re-run is a no-op.
 */
-async function up$26(db) {
+async function up$27(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7988,7 +7989,7 @@ async function up$26(db) {
       ADD COLUMN source_tar_digest TEXT
   `.execute(db);
 }
-async function down$26(db) {
+async function down$27(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS source_tar_digest
   `.execute(db);
@@ -7996,8 +7997,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/134_dispatch_queue_ownership.ts
 var _134_dispatch_queue_ownership_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Coordinator ownership for the job-dispatch plane.
@@ -8040,7 +8041,7 @@ async function colExists$5(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const DISPATCH_QUEUE_COLUMNS = [["owner_instance_id", "TEXT"], ["dispatched_at", "TIMESTAMPTZ"]];
-async function up$25(db) {
+async function up$26(db) {
 	for (const [name, type] of DISPATCH_QUEUE_COLUMNS) if (!await colExists$5(db, "dispatch_queue", name)) await sql`
         ALTER TABLE public.dispatch_queue
           ADD COLUMN ${sql.raw(name)} ${sql.raw(type)}
@@ -8101,7 +8102,7 @@ async function up$25(db) {
      WHERE status = 'active'
   `.execute(db);
 }
-async function down$25(db) {
+async function down$26(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_concurrency_groups_active_unique`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.cluster_instances`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelling_at`.execute(db);
@@ -8112,8 +8113,8 @@ async function down$25(db) {
 //#endregion
 //#region src/db/migrations/135_cluster_settings_retention_days.ts
 var _135_cluster_settings_retention_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Database-side retention windows on `cluster_settings`. Cold-store
@@ -8167,20 +8168,20 @@ async function columnExists$2(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists === true;
 }
-async function up$24(db) {
+async function up$25(db) {
 	for (const { name, type } of COLUMNS$2) {
 		if (await columnExists$2(db, name)) continue;
 		await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.raw(name)} ${sql.raw(type)}`.execute(db);
 	}
 }
-async function down$24(db) {
+async function down$25(db) {
 	for (const { name } of COLUMNS$2) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.raw(name)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/136_master_key_wrapped_tables_key_version.ts
 var _136_master_key_wrapped_tables_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * `key_version` on the master-key-wrapped tables that lacked it (`orchestrator_signing_keys`
@@ -8198,7 +8199,7 @@ const TABLES = [
 	"run_ephemeral_keys",
 	"run_secret_outputs"
 ];
-async function up$23(db) {
+async function up$24(db) {
 	for (const table of TABLES) {
 		if ((await sql`
       SELECT EXISTS (
@@ -8214,7 +8215,7 @@ async function up$23(db) {
     `.execute(db);
 	}
 }
-async function down$23(db) {
+async function down$24(db) {
 	for (const table of TABLES) await sql`
       ALTER TABLE public.${sql.raw(table)} DROP COLUMN IF EXISTS key_version
     `.execute(db);
@@ -8222,8 +8223,8 @@ async function down$23(db) {
 //#endregion
 //#region src/db/migrations/137_execution_runs_pr_head_context.ts
 var _137_execution_runs_pr_head_context_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add the pull-request head context to `execution_runs`: `head_ref TEXT`,
@@ -8251,7 +8252,7 @@ const COLUMNS$1 = [
 	["head_repository", "TEXT"],
 	["is_fork", "BOOLEAN"]
 ];
-async function up$22(db) {
+async function up$23(db) {
 	for (const [name, type] of COLUMNS$1) {
 		if ((await sql`
       SELECT EXISTS (
@@ -8267,7 +8268,7 @@ async function up$22(db) {
     `.execute(db);
 	}
 }
-async function down$22(db) {
+async function down$23(db) {
 	for (const [name] of COLUMNS$1) await sql`
       ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS ${sql.raw(name)}
     `.execute(db);
@@ -8275,8 +8276,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/138_execution_runs_subject_trigger_event.ts
 var _138_execution_runs_subject_trigger_event_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add `execution_runs.subject_trigger_event`.
@@ -8295,7 +8296,7 @@ var _138_execution_runs_subject_trigger_event_exports = /* @__PURE__ */ __export
 * policy pins. Idempotent.
 */
 const COLUMN$1 = "subject_trigger_event";
-async function up$21(db) {
+async function up$22(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8309,7 +8310,7 @@ async function up$21(db) {
       ADD COLUMN ${sql.raw(COLUMN$1)} TEXT
   `.execute(db);
 }
-async function down$21(db) {
+async function down$22(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS ${sql.raw(COLUMN$1)}
   `.execute(db);
@@ -8317,8 +8318,8 @@ async function down$21(db) {
 //#endregion
 //#region src/db/migrations/139_admin_token_subject.ts
 var _139_admin_token_subject_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add `admin_tokens.subject TEXT`, nullable.
@@ -8338,7 +8339,7 @@ var _139_admin_token_subject_exports = /* @__PURE__ */ __exportAll({
 * recorded holder. Idempotent.
 */
 const COLUMN = "subject";
-async function up$20(db) {
+async function up$21(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8352,7 +8353,7 @@ async function up$20(db) {
       ADD COLUMN ${sql.raw(COLUMN)} TEXT
   `.execute(db);
 }
-async function down$20(db) {
+async function down$21(db) {
 	await sql`
     ALTER TABLE public.admin_tokens DROP COLUMN IF EXISTS ${sql.raw(COLUMN)}
   `.execute(db);
@@ -8360,8 +8361,8 @@ async function down$20(db) {
 //#endregion
 //#region src/db/migrations/140_dispatch_queue_canonical_labels.ts
 var _140_dispatch_queue_canonical_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * The whitespace `btrim` strips, matching the `String.prototype.trim` that `canonicalizeLabel`
@@ -8399,7 +8400,7 @@ const TRIM_CHARS = String.raw`E' \t\n\r\f\x0B'`;
 *
 * Idempotent: each `UPDATE` selects only rows with a non-canonical element.
 */
-async function up$19(db) {
+async function up$20(db) {
 	const trim = sql.raw(TRIM_CHARS);
 	await sql`
     UPDATE public.dispatch_queue
@@ -8434,12 +8435,12 @@ async function up$19(db) {
 * compares agent labels verbatim against canonicalized rows, so a fleet with non-lowercase
 * labels strands those rows until they expire, drain, or are re-enqueued.
 */
-async function down$19() {}
+async function down$20() {}
 //#endregion
 //#region src/db/migrations/141_event_log_shed.ts
 var _141_event_log_shed_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Extend the event_log.status CHECK constraint with 'shed' so the orchestrator
@@ -8452,7 +8453,7 @@ var _141_event_log_shed_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$18(db) {
+async function up$19(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -8462,7 +8463,7 @@ async function up$18(db) {
     ])))
   `.execute(db);
 }
-async function down$18(db) {
+async function down$19(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -8475,8 +8476,8 @@ async function down$18(db) {
 //#endregion
 //#region src/db/migrations/142_sweep_deprecated_columns.ts
 var _142_sweep_deprecated_columns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Sweep the columns and stored values no code path reads or writes. Data first, then schema:
@@ -8497,7 +8498,7 @@ var _142_sweep_deprecated_columns_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: every UPDATE matches nothing on a re-run and every DROP is IF EXISTS.
 */
 const BATCH_SIZE$1 = 5e3;
-async function up$17(db) {
+async function up$18(db) {
 	for (;;) if (((await sql`
       UPDATE public.execution_runs
          SET trust_tier = 'unknown'
@@ -8523,12 +8524,12 @@ async function up$17(db) {
 	await sql`ALTER TABLE public.org_trust_policy DROP COLUMN IF EXISTS workflow_change_policy`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS source_tar_hash`.execute(db);
 }
-async function down$17() {}
+async function down$18() {}
 //#endregion
 //#region src/db/migrations/143_execution_jobs_precursor_result.ts
 var _143_execution_jobs_precursor_result_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add `execution_jobs.precursor_result`: the payload a precursor job (source-pack build, init,
@@ -8543,7 +8544,7 @@ var _143_execution_jobs_precursor_result_exports = /* @__PURE__ */ __exportAll({
 * Nullable, no default: NULL means "no precursor payload" (every ordinary job and older row).
 * Idempotent.
 */
-async function up$16(db) {
+async function up$17(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8557,7 +8558,7 @@ async function up$16(db) {
       ADD COLUMN precursor_result JSONB
   `.execute(db);
 }
-async function down$16(db) {
+async function down$17(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS precursor_result
   `.execute(db);
@@ -8565,8 +8566,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/144_execution_runs_registration_window.ts
 var _144_execution_runs_registration_window_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add `execution_runs.registration_window_instance_id TEXT NULL` — the
@@ -8588,7 +8589,7 @@ var _144_execution_runs_registration_window_exports = /* @__PURE__ */ __exportAl
 *
 * Idempotent: the add is guarded on existence and the drop uses IF EXISTS.
 */
-async function up$15(db) {
+async function up$16(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8602,7 +8603,7 @@ async function up$15(db) {
       ADD COLUMN registration_window_instance_id TEXT
   `.execute(db);
 }
-async function down$15(db) {
+async function down$16(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS registration_window_instance_id
   `.execute(db);
@@ -8610,8 +8611,8 @@ async function down$15(db) {
 //#endregion
 //#region src/db/migrations/145_execution_runs_workflow_provenance.ts
 var _145_execution_runs_workflow_provenance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Record the workflow repository's commit and registered branch for a run whose
@@ -8638,19 +8639,19 @@ async function colExists$4(db, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$14(db) {
+async function up$15(db) {
 	if (!await colExists$4(db, "workflow_sha")) await sql`ALTER TABLE public.execution_runs ADD COLUMN workflow_sha text`.execute(db);
 	if (!await colExists$4(db, "workflow_branch")) await sql`ALTER TABLE public.execution_runs ADD COLUMN workflow_branch text`.execute(db);
 }
-async function down$14(db) {
+async function down$15(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_branch`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_sha`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/146_pending_job_contexts_context_resolution.ts
 var _146_pending_job_contexts_context_resolution_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Record, with a held job's pending dispatch context, what the release path
@@ -8676,18 +8677,18 @@ async function colExists$3(db) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$13(db) {
+async function up$14(db) {
 	if (!await colExists$3(db)) await sql`ALTER TABLE public.pending_job_contexts ADD COLUMN context_resolution jsonb`.execute(db);
 }
-async function down$13(db) {
+async function down$14(db) {
 	await sql`ALTER TABLE public.pending_job_contexts DROP COLUMN IF EXISTS context_resolution`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/147_sealed_job_secrets.ts
 var _147_sealed_job_secrets_exports = /* @__PURE__ */ __exportAll({
 	SEALED_SECRETS_TABLES: () => SEALED_SECRETS_TABLES,
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * `sealed_secrets` holds a stored job's secret fields under the orchestrator master key, beside
@@ -8714,17 +8715,17 @@ async function colExists$2(db, table) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$12(db) {
+async function up$13(db) {
 	for (const table of SEALED_SECRETS_TABLES) if (!await colExists$2(db, table)) await sql`ALTER TABLE ${sql.table(`public.${table}`)} ADD COLUMN sealed_secrets text`.execute(db);
 }
-async function down$12(db) {
+async function down$13(db) {
 	for (const table of SEALED_SECRETS_TABLES) await sql`ALTER TABLE ${sql.table(`public.${table}`)} DROP COLUMN IF EXISTS sealed_secrets`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/148_cluster_settings_sealed_secrets_retry_backoff_ms.ts
 var _148_cluster_settings_sealed_secrets_retry_backoff_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * How long a coordinator leaves a queued job alone after failing to open its sealed secrets
@@ -8737,7 +8738,7 @@ var _148_cluster_settings_sealed_secrets_retry_backoff_ms_exports = /* @__PURE__
 *
 * Idempotent: guarded on column existence.
 */
-async function up$11(db) {
+async function up$12(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8748,14 +8749,14 @@ async function up$11(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN sealed_secrets_retry_backoff_ms BIGINT`.execute(db);
 }
-async function down$11(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS sealed_secrets_retry_backoff_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/149_workflow_registrations_dep_cache_key.ts
 var _149_workflow_registrations_dep_cache_key_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * The registering lock file's dependency-cache key: `lockfile_hash` (`lockfileHash`, the
@@ -8779,19 +8780,19 @@ async function colExists$1(db, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$10(db) {
+async function up$11(db) {
 	if (!await colExists$1(db, "lockfile_hash")) await sql`ALTER TABLE public.workflow_registrations ADD COLUMN lockfile_hash text`.execute(db);
 	if (!await colExists$1(db, "siblings_digest")) await sql`ALTER TABLE public.workflow_registrations ADD COLUMN siblings_digest text`.execute(db);
 }
-async function down$10(db) {
+async function down$11(db) {
 	await sql`ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS siblings_digest`.execute(db);
 	await sql`ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS lockfile_hash`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/150_execution_runs_status_epoch.ts
 var _150_execution_runs_status_epoch_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add `execution_runs.status_epoch`: the run's status generation. The tracker raises it each time
@@ -8802,7 +8803,7 @@ var _150_execution_runs_status_epoch_exports = /* @__PURE__ */ __exportAll({
 * The constant default 0 adds the column without a table rewrite; no existing row was reopened
 * under this counter. Idempotent.
 */
-async function up$9(db) {
+async function up$10(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8813,14 +8814,14 @@ async function up$9(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.execution_runs ADD COLUMN status_epoch INTEGER NOT NULL DEFAULT 0`.execute(db);
 }
-async function down$9(db) {
+async function down$10(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS status_epoch`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/151_workflow_registrations_dep_cache_key_sha.ts
 var _151_workflow_registrations_dep_cache_key_sha_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * `dep_cache_key_sha`: the `commit_sha` stored with `lockfile_hash` and `siblings_digest`. A run
@@ -8844,18 +8845,18 @@ async function colExists(db) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$8(db) {
+async function up$9(db) {
 	if (await colExists(db)) return;
 	await sql`ALTER TABLE public.workflow_registrations ADD COLUMN dep_cache_key_sha text`.execute(db);
 }
-async function down$8(db) {
+async function down$9(db) {
 	await sql`ALTER TABLE public.workflow_registrations DROP COLUMN IF EXISTS dep_cache_key_sha`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/152_org_settings_cache_upload_settle_timeout.ts
 var _152_org_settings_cache_upload_settle_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Per-org bound on how long a build job's `job.status success` waits for the cache publish
@@ -8865,7 +8866,7 @@ var _152_org_settings_cache_upload_settle_timeout_exports = /* @__PURE__ */ __ex
 *
 * Idempotent.
 */
-async function up$7(db) {
+async function up$8(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8879,7 +8880,7 @@ async function up$7(db) {
       ADD COLUMN cache_upload_settle_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$7(db) {
+async function down$8(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS cache_upload_settle_timeout_ms
   `.execute(db);
@@ -8887,8 +8888,8 @@ async function down$7(db) {
 //#endregion
 //#region src/db/migrations/153_execution_runs_cancel_force.ts
 var _153_execution_runs_cancel_force_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Add `execution_runs.cancel_force BOOLEAN` (nullable, no default).
@@ -8902,7 +8903,7 @@ var _153_execution_runs_cancel_force_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$6(db) {
+async function up$7(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -8916,7 +8917,7 @@ async function up$6(db) {
       ADD COLUMN cancel_force BOOLEAN
   `.execute(db);
 }
-async function down$6(db) {
+async function down$7(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancel_force
   `.execute(db);
@@ -8924,8 +8925,8 @@ async function down$6(db) {
 //#endregion
 //#region src/db/migrations/154_cluster_settings_firecracker_api_socket_wait.ts
 var _154_cluster_settings_firecracker_api_socket_wait_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Cluster-global wait for a Firecracker VM's API socket after the jailer starts.
@@ -8947,17 +8948,17 @@ async function columnExists$1(db, table, column) {
   `.execute(db)).rows[0]?.exists === true;
 }
 const COLUMNS = ["firecracker_api_socket_wait_ms"];
-async function up$5(db) {
+async function up$6(db) {
 	for (const column of COLUMNS) if (!await columnExists$1(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
-async function down$5(db) {
+async function down$6(db) {
 	for (const column of COLUMNS) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/155_org_settings_reroute_spawn_retry.ts
 var _155_org_settings_reroute_spawn_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Add the two per-org spawn-retry columns a worker applies to a rerouted job (both nullable):
@@ -8972,11 +8973,11 @@ var _155_org_settings_reroute_spawn_retry_exports = /* @__PURE__ */ __exportAll(
 *
 * Idempotent: each add is guarded on column existence.
 */
-async function up$4(db) {
+async function up$5(db) {
 	await addColumnIfMissing(db, "reroute_spawn_max_attempts", "INTEGER");
 	await addColumnIfMissing(db, "reroute_spawn_retry_backoff_ms", "BIGINT");
 }
-async function down$4(db) {
+async function down$5(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_spawn_max_attempts`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_spawn_retry_backoff_ms`.execute(db);
 }
@@ -8994,8 +8995,8 @@ async function addColumnIfMissing(db, column, type) {
 //#endregion
 //#region src/db/migrations/156_kici_events_match_outcome.ts
 var _156_kici_events_match_outcome_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Record how the event router resolved each internal event:
@@ -9010,12 +9011,12 @@ var _156_kici_events_match_outcome_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: `ADD COLUMN IF NOT EXISTS`.
 */
-async function up$3(db) {
+async function up$4(db) {
 	await sql`ALTER TABLE public.kici_events
               ADD COLUMN IF NOT EXISTS match_outcome TEXT,
               ADD COLUMN IF NOT EXISTS matched_count INTEGER`.execute(db);
 }
-async function down$3(db) {
+async function down$4(db) {
 	await sql`ALTER TABLE public.kici_events
               DROP COLUMN IF EXISTS match_outcome,
               DROP COLUMN IF EXISTS matched_count`.execute(db);
@@ -9023,8 +9024,8 @@ async function down$3(db) {
 //#endregion
 //#region src/db/migrations/157_host_roster_identity_source.ts
 var _157_host_roster_identity_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * `host_roster.identity_source` (`agent` | `operator` | `platform`): who last set a host's
@@ -9039,7 +9040,7 @@ var _157_host_roster_identity_source_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent.
 */
-async function up$2(db) {
+async function up$3(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -9058,14 +9059,14 @@ async function up$2(db) {
     UPDATE public.host_roster SET identity_source = 'agent' WHERE platform IS NOT NULL
   `.execute(db);
 }
-async function down$2(db) {
+async function down$3(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS identity_source`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/158_normalize_legacy_values.ts
 var _158_normalize_legacy_values_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * Rewrite every stored legacy value the readers no longer accept, then drop
@@ -9108,7 +9109,7 @@ async function columnExists(db, table, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$1(db) {
+async function up$2(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'reviewer' WHERE hold_type = 'approval'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'timer' WHERE hold_type = 'wait_timer'`.execute(db);
 	for (const table of STATUS_TABLES) {
@@ -9126,12 +9127,12 @@ async function up$1(db) {
 	await sql`ALTER TABLE public.org_trust_policy ALTER COLUMN approval_expiry_seconds SET NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.org_trust_policy DROP COLUMN IF EXISTS approval_expiry_hours`.execute(db);
 }
-async function down$1() {}
+async function down$2() {}
 //#endregion
 //#region src/db/migrations/159_org_id_widen_to_source_width.ts
 var _159_org_id_widen_to_source_width_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * Widen every `org_id varchar(16)` column to `varchar(255)`, the width of the `customer_id`
@@ -9158,14 +9159,40 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up(db) {
+async function up$1(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(255)`).execute(db);
 }
 /** Fails when a row holds an org id longer than 16 characters, rather than truncating it. */
-async function down(db) {
+async function down$1(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
 //#endregion
+//#region src/db/migrations/160_execution_jobs_workflow_name.ts
+var _160_execution_jobs_workflow_name_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* `execution_jobs.workflow_name`: the workflow that defines the job. A fixture
+* run with no `--workflow` runs every matched workflow under one run id, so
+* `execution_runs.workflow_name` (the first matched workflow) does not say
+* which workflow a job belongs to.
+*
+* Nullable, with no backfill: a row written before this column reads as
+* unknown, and the readers fall back to the run's workflow for a run that can
+* span only one.
+*
+* Idempotent.
+*/
+async function up(db) {
+	await sql`
+    ALTER TABLE public.execution_jobs ADD COLUMN IF NOT EXISTS workflow_name text
+  `.execute(db);
+}
+async function down(db) {
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS workflow_name`.execute(db);
+}
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -9328,7 +9355,8 @@ function createMigrationProvider() {
 			"156_kici_events_match_outcome": _156_kici_events_match_outcome_exports,
 			"157_host_roster_identity_source": _157_host_roster_identity_source_exports,
 			"158_normalize_legacy_values": _158_normalize_legacy_values_exports,
-			"159_org_id_widen_to_source_width": _159_org_id_widen_to_source_width_exports
+			"159_org_id_widen_to_source_width": _159_org_id_widen_to_source_width_exports,
+			"160_execution_jobs_workflow_name": _160_execution_jobs_workflow_name_exports
 		};
 	} };
 }
@@ -11162,6 +11190,11 @@ const SCHEMA_SNAPSHOT = {
 			nullable: true,
 			default: null
 		},
+		"execution_jobs.workflow_name": {
+			type: "text",
+			nullable: true,
+			default: null
+		},
 		"execution_runs.archive_object_key": {
 			type: "text",
 			nullable: true,
@@ -18769,8 +18802,10 @@ function renderSourceListText(githubSources, genericSources, hasOrg, opts) {
 		console.log("Tip: use --org <orgId> to also list generic sources.");
 	}
 }
-/** Matches the kici-admin global `--url` default. */
-const DEFAULT_ORCH_URL = process.env.KICI_ADMIN_URL ?? DEFAULT_ADMIN_URL;
+/** Mirrors the kici-admin global `--url`: KICI_ADMIN_URL, read at parse time, else the default. */
+function baseUrlOption() {
+	return new Option("--base-url <url>", "Orchestrator base URL").env("KICI_ADMIN_URL").default(DEFAULT_ADMIN_URL);
+}
 /** Null when the row is not a valid local source. */
 function parseLocalConfig(s) {
 	if (s.provider_type !== "local" || !s.git_config) return null;
@@ -19382,7 +19417,7 @@ function registerSourceCommands(program, getClient) {
 		await getClient().disableGenericSource(id);
 		console.log(`Generic source disabled: ${id}`);
 	}));
-	src.command("trigger-local <id>").description("Trigger a run against a local source (reads HEAD when --ref/--sha omitted)").option("--event <event>", "push | pull_request", "push").option("--ref <ref>", "Git ref (default: repo HEAD branch)").option("--sha <sha>", "Commit SHA (default: repo HEAD)").option("--before <sha>", "Commit before the push; the changed files are before..sha (default: parent of --sha)").option("--repo-full-name <name>", "owner/name identifier used in the payload", "local/repo").option("--base-url <url>", "Orchestrator base URL", DEFAULT_ORCH_URL).action(cliAction(async (id, opts) => {
+	src.command("trigger-local <id>").description("Trigger a run against a local source (reads HEAD when --ref/--sha omitted)").option("--event <event>", "push | pull_request", "push").option("--ref <ref>", "Git ref (default: repo HEAD branch)").option("--sha <sha>", "Commit SHA (default: repo HEAD)").option("--before <sha>", "Commit before the push; the changed files are before..sha (default: parent of --sha)").option("--repo-full-name <name>", "owner/name identifier used in the payload", "local/repo").addOption(baseUrlOption()).action(cliAction(async (id, opts) => {
 		const { source } = await getClient().getGenericSource(id);
 		const cfg = parseLocalConfig(source);
 		if (!cfg) {
@@ -19409,7 +19444,7 @@ function registerSourceCommands(program, getClient) {
 		console.log(`Triggered local source ${id}: HTTP ${status}`);
 		if (status >= 400) process.exit(1);
 	}));
-	src.command("install-hook <id>").description("Install a post-receive hook in the local source repo that triggers runs on push").option("--repo <path>", "Repo path (default: the source repoBasePath)").option("--base-url <url>", "Orchestrator base URL", DEFAULT_ORCH_URL).action(cliAction(async (id, opts) => {
+	src.command("install-hook <id>").description("Install a post-receive hook in the local source repo that triggers runs on push").option("--repo <path>", "Repo path (default: the source repoBasePath)").addOption(baseUrlOption()).action(cliAction(async (id, opts) => {
 		const { source } = await getClient().getGenericSource(id);
 		const cfg = parseLocalConfig(source);
 		if (!cfg) {
@@ -19585,6 +19620,33 @@ function registerWorkflowCommands(program, getClient) {
 	}));
 }
 //#endregion
+//#region src/cli/commands/shared/run-ref.ts
+/** Resolve a `kici-admin runs` run id: a full id, or a unique prefix (like a git short SHA). */
+const AMBIGUOUS_SHOWN = 5;
+const FIND_HINT = "'kici-admin runs list' shows full run ids";
+/** The full run id `ref` names; a prefix resolves through the run list. */
+async function resolveRunRef(client, ref) {
+	const parsed = parseRunIdRef(ref);
+	if (parsed.kind === "uuid") return parsed.runId;
+	if (parsed.kind === "invalid") throw new Error(invalidRunIdMessage(ref, parsed.reason, FIND_HINT));
+	const { runs, total } = await client.listRuns({
+		runIdPrefix: parsed.hex,
+		limit: AMBIGUOUS_SHOWN
+	});
+	const ids = runs.map((r) => String(r.runId));
+	const matches = ids.filter((id) => runIdHasPrefix(id, parsed.hex));
+	if (matches.length < ids.length && total > ids.length) throw new Error(prefixUnsupported(ref));
+	return pickRunIdMatch({
+		ref,
+		matches,
+		unseen: total - ids.length,
+		findHint: FIND_HINT
+	});
+}
+function prefixUnsupported(ref) {
+	return `This orchestrator cannot look up the run id prefix '${ref}'; pass the full run id (${FIND_HINT}).`;
+}
+//#endregion
 //#region src/cli/commands/runs.ts
 function formatDuration(ms) {
 	if (ms == null) return "-";
@@ -19593,6 +19655,25 @@ function formatDuration(ms) {
 	if (secs < 60) return `${secs}s`;
 	return `${Math.floor(secs / 60)}m${secs % 60}s`;
 }
+/** Every workflow a run spans; an older orchestrator reports only the first. */
+function runWorkflows(run) {
+	return run.workflowNames?.length ? run.workflowNames : [run.workflowName];
+}
+/**
+* The `workflow` cell of `runs list`: the run's workflow, plus how many more it
+* spans (`hello-world +3`), so a run of several workflows never reads as one.
+*/
+function workflowListCell(run) {
+	const names = runWorkflows(run);
+	return names.length > 1 ? `${names[0]} +${names.length - 1}` : names[0];
+}
+/**
+* A job's label in the per-job lines: qualified with its workflow when the run
+* spans several, where two jobs can share a name.
+*/
+function jobLabel(job, spansWorkflows) {
+	return spansWorkflows && job.workflowName ? `${job.workflowName} / ${job.jobName}` : job.jobName;
+}
 /**
 * Header lines naming where an organization-wide run's workflow is defined.
 * "Defined in" prints only when the workflow repository differs from the run's
@@ -19606,6 +19687,42 @@ function workflowProvenanceLines(run) {
 	if (run.workflowBranch) lines.push(`  Workflow branch: ${run.workflowBranch}`);
 	return lines;
 }
+/**
+* A job's steps in run order: setup and init pseudo-steps first, whatever order the
+* orchestrator sent. An older orchestrator orders init steps by their stored index, last.
+*/
+function stepsInRunOrder(steps) {
+	return [...steps].sort(compareStepsByPhase);
+}
+/**
+* The `#` cell of a step row: the step index, or `init[<n>]` for an init step, whose
+* stored index is a high internal value and not a position among the steps.
+*/
+function stepNumberCell(step) {
+	const initIndex = initStepIndex(step.stepType);
+	return initIndex === void 0 ? String(step.stepIndex) : initStepLabel(initIndex);
+}
+/** The `type` cell of a `runs show` step row: blank for a plain step, `init` for any init. */
+function stepTypeCell(stepType) {
+	if (stepPhase(stepType) === StepPhase.enum.init) return StepPhase.enum.init;
+	return stepType === "step" ? "" : stepType;
+}
+/**
+* The stored step index `runs logs --step` names. An init step is shown as `init[<n>]`,
+* not by its stored index, so that label resolves through the job's steps; any other
+* value passes through for the server to validate.
+*/
+async function resolveStepRef(client, runId, jobId, step) {
+	const ref = String(step);
+	const initIndex = parseInitStepRef(ref);
+	if (initIndex === void 0) return ref;
+	const { jobs } = await client.getRunJobs(runId, { includeSteps: true });
+	const job = jobs.find((j) => j.jobId === jobId);
+	if (!job) throw new Error(`Job ${jobId} not found in run ${runId}`);
+	const match = (job.steps ?? []).find((s) => s.stepType === initStepType(initIndex));
+	if (!match) throw new Error(`Job ${jobId} has no ${initStepLabel(initIndex)} step`);
+	return String(match.stepIndex);
+}
 /** The step index of a job's setup log: the clone, the install and the module load. */
 const SETUP_LOG_STEP_INDEX = -1;
 /**
@@ -19613,14 +19730,15 @@ const SETUP_LOG_STEP_INDEX = -1;
 * recorded, or a log is stored and holds nothing. `null` when the step has
 * lines, or when the orchestrator does not report which case applies.
 */
-function emptyStepLogNote(stepIndex, logs) {
+function emptyStepLogNote(step, logs) {
 	if (logs.totalLines > 0 || logs.recorded === void 0) return null;
-	if (stepIndex === SETUP_LOG_STEP_INDEX) return logs.recorded ? "(the setup log for this job is empty)" : "(no setup log recorded for this job)";
-	return logs.recorded ? `(the log for step ${stepIndex} is empty)` : `(no log recorded for step ${stepIndex})`;
+	if (step === SETUP_LOG_STEP_INDEX) return logs.recorded ? "(the setup log for this job is empty)" : "(no setup log recorded for this job)";
+	return logs.recorded ? `(the log for step ${step} is empty)` : `(no log recorded for step ${step})`;
 }
+const RUN_ID_ARG_HELP = "Run id, or its first 4 or more characters";
 function registerRunsCommands(program, getClient) {
 	const runs = program.command("runs").description("Inspect execution runs, jobs, and steps");
-	runs.command("list").description("List execution runs (admin API: /api/v1/admin/runs)").option("--status <statuses>", "Filter by run status. Accepts a single value or a comma-separated list (e.g. success,failed)").option("--workflow-name <name>", "Filter by workflow name").option("--repo <ownerRepo>", "Filter by repo identifier (owner/repo)").option("--since <iso8601>", "Only include runs with created_at strictly later than this ISO-8601 timestamp").option("--count", "Return only the count of matching runs, skipping the row listing").option("--limit <n>", "Max results (default 20, max 100)", "20").option("--offset <n>", "Skip first N results", "0").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (opts) => {
+	runs.command("list").description("List execution runs (admin API: /api/v1/admin/runs)").option("--status <statuses>", "Filter by run status. Accepts a single value or a comma-separated list (e.g. success,failed)").option("--workflow-name <name>", "Filter by workflow name. A run that spans several workflows matches any of them").option("--repo <ownerRepo>", "Filter by repo identifier (owner/repo)").option("--since <iso8601>", "Only include runs with created_at strictly later than this ISO-8601 timestamp").option("--count", "Return only the count of matching runs, skipping the row listing").option("--limit <n>", "Max results (default 20, max 100)", "20").option("--offset <n>", "Skip first N results", "0").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (opts) => {
 		if (opts.count) {
 			const data = await getClient().countRuns({
 				status: opts.status,
@@ -19660,7 +19778,7 @@ function registerRunsCommands(program, getClient) {
 		];
 		const rows = data.runs.map((r) => [
 			r.runId,
-			r.workflowName,
+			workflowListCell(r),
 			r.status,
 			r.repoIdentifier,
 			r.ref,
@@ -19672,7 +19790,8 @@ function registerRunsCommands(program, getClient) {
 		console.log("");
 		console.log(`Showing ${data.runs.length} of ${data.total} (offset ${data.offset}, limit ${data.limit})`);
 	}));
-	runs.command("show <runId>").description("Show run detail with jobs and steps").option("--json", "Emit raw JSON instead of formatted output").action(cliAction(async (runId, opts) => {
+	runs.command("show").argument("<runId>", RUN_ID_ARG_HELP).description("Show run detail with jobs and steps").option("--json", "Emit raw JSON instead of formatted output").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const client = getClient();
 		const [runRespRaw, jobsRespRaw] = await Promise.all([client.getRun(runId), client.getRunJobs(runId, { includeSteps: true })]);
 		const runResp = runRespRaw;
@@ -19686,8 +19805,11 @@ function registerRunsCommands(program, getClient) {
 			return;
 		}
 		const { run, jobs } = data;
+		const workflows = runWorkflows(run);
+		const spansWorkflows = workflows.length > 1;
 		console.log(`Run: ${run.runId}`);
-		console.log(`  Workflow:    ${run.workflowName}`);
+		if (spansWorkflows) console.log(`  Workflows:   ${workflows.join(", ")}`);
+		else console.log(`  Workflow:    ${run.workflowName}`);
 		console.log(`  Status:      ${run.status}`);
 		console.log(`  Repo:        ${run.repoIdentifier}`);
 		console.log(`  Ref:         ${run.ref}`);
@@ -19713,6 +19835,7 @@ function registerRunsCommands(program, getClient) {
 		const jobHeaders = [
 			"job_id",
 			"name",
+			"workflow",
 			"status",
 			"agent",
 			"duration",
@@ -19721,6 +19844,7 @@ function registerRunsCommands(program, getClient) {
 		const jobRows = jobs.map((j) => [
 			j.jobId,
 			j.jobName,
+			j.workflowName ?? "-",
 			j.status,
 			j.agentId ?? "-",
 			formatDuration(j.durationMs),
@@ -19730,12 +19854,12 @@ function registerRunsCommands(program, getClient) {
 		const unroutableJobs = jobs.filter((j) => j.routingReason && (j.status === ExecutionJobStatus.enum.pending || j.status === ExecutionJobStatus.enum.queued));
 		if (unroutableJobs.length > 0) {
 			console.log("");
-			for (const job of unroutableJobs) console.log(`  ! ${job.jobName}: ${job.routingReason}`);
+			for (const job of unroutableJobs) console.log(`  ! ${jobLabel(job, spansWorkflows)}: ${job.routingReason}`);
 		}
 		const jobsWithSteps = jobs.filter((j) => (j.steps?.length ?? 0) > 0);
 		if (jobsWithSteps.length > 0) for (const job of jobsWithSteps) {
 			console.log("");
-			console.log(`Steps for ${job.jobName} (${job.jobId}):`);
+			console.log(`Steps for ${jobLabel(job, spansWorkflows)} (${job.jobId}):`);
 			const stepHeaders = [
 				"#",
 				"name",
@@ -19744,18 +19868,19 @@ function registerRunsCommands(program, getClient) {
 				"duration",
 				"type"
 			];
-			const stepRows = (job.steps ?? []).map((s) => [
-				String(s.stepIndex),
+			const stepRows = stepsInRunOrder(job.steps ?? []).map((s) => [
+				stepNumberCell(s),
 				s.stepName,
 				s.status,
 				s.exitCode != null ? String(s.exitCode) : "-",
 				formatDuration(s.durationMs),
-				s.stepType === "step" ? "" : s.stepType
+				stepTypeCell(s.stepType)
 			]);
 			console.log(renderTable(stepHeaders, stepRows));
 		}
 	}));
-	runs.command("structured <runId>").description("Show the provenance-tagged structured run result (agent read path; /structured)").option("--json", "Emit the raw AgentRunResult (untrusted envelopes preserved)").action(cliAction(async (runId, opts) => {
+	runs.command("structured").argument("<runId>", RUN_ID_ARG_HELP).description("Show the provenance-tagged structured run result (agent read path; /structured)").option("--json", "Emit the raw AgentRunResult (untrusted envelopes preserved)").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const result = await getClient().getRunStructured(runId);
 		if (opts.json) {
 			console.log(JSON.stringify(result, null, 2));
@@ -19798,8 +19923,8 @@ function registerRunsCommands(program, getClient) {
 				"exit",
 				"duration"
 			];
-			const stepRows = job.steps.map((s) => [
-				String(s.stepIndex),
+			const stepRows = stepsInRunOrder(job.steps).map((s) => [
+				stepNumberCell(s),
 				uv(s.stepName),
 				s.status,
 				s.exitCode != null ? String(s.exitCode) : "-",
@@ -19808,7 +19933,8 @@ function registerRunsCommands(program, getClient) {
 			console.log(renderTable(stepHeaders, stepRows));
 		}
 	}));
-	runs.command("jobs <runId>").description("List jobs for a run (admin API: /api/v1/admin/runs/:runId/jobs)").option("--include-steps", "Embed step list inside each job (default false)").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runId, opts) => {
+	runs.command("jobs").argument("<runId>", RUN_ID_ARG_HELP).description("List jobs for a run (admin API: /api/v1/admin/runs/:runId/jobs)").option("--include-steps", "Embed step list inside each job (default false)").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const response = await getClient().getRunJobs(runId, { includeSteps: Boolean(opts.includeSteps) });
 		if (opts.json) {
 			console.log(JSON.stringify(response, null, 2));
@@ -19821,6 +19947,7 @@ function registerRunsCommands(program, getClient) {
 		const headers = [
 			"job_id",
 			"name",
+			"workflow",
 			"status",
 			"agent",
 			"duration",
@@ -19829,38 +19956,44 @@ function registerRunsCommands(program, getClient) {
 		const rows = response.jobs.map((j) => [
 			j.jobId,
 			j.jobName,
+			j.workflowName ?? "-",
 			j.status,
 			j.agentId ?? "-",
 			formatDuration(j.durationMs),
 			j.startedAt ?? "-"
 		]);
 		console.log(renderTable(headers, rows));
-		if (opts.includeSteps) for (const job of response.jobs) {
-			const steps = job.steps ?? [];
-			if (steps.length === 0) continue;
-			console.log("");
-			console.log(`Steps for ${job.jobName} (${job.jobId}):`);
-			const stepHeaders = [
-				"#",
-				"name",
-				"status",
-				"exit",
-				"duration"
-			];
-			const stepRows = steps.map((s) => [
-				String(s.stepIndex),
-				s.stepName,
-				s.status,
-				s.exitCode != null ? String(s.exitCode) : "-",
-				formatDuration(s.durationMs)
-			]);
-			console.log(renderTable(stepHeaders, stepRows));
+		if (opts.includeSteps) {
+			const spansWorkflows = new Set(response.jobs.map((j) => j.workflowName).filter(Boolean)).size > 1;
+			for (const job of response.jobs) {
+				const steps = job.steps ?? [];
+				if (steps.length === 0) continue;
+				console.log("");
+				console.log(`Steps for ${jobLabel(job, spansWorkflows)} (${job.jobId}):`);
+				const stepHeaders = [
+					"#",
+					"name",
+					"status",
+					"exit",
+					"duration"
+				];
+				const stepRows = stepsInRunOrder(steps).map((s) => [
+					stepNumberCell(s),
+					s.stepName,
+					s.status,
+					s.exitCode != null ? String(s.exitCode) : "-",
+					formatDuration(s.durationMs)
+				]);
+				console.log(renderTable(stepHeaders, stepRows));
+			}
 		}
 	}));
-	runs.command("logs <runId>").description("Print a page of a step log (admin API: /api/v1/admin/runs/:runId/jobs/:jobId/steps/:i/logs)").requiredOption("--job <jobId>", "Job id (the dispatch_queue row id for an eval round)").option("--step <n>", "Step index (default 0; -1 is the job setup log)", "0").option("--limit <n>", "Max lines to return (default 500, server caps at 2000)", "500").option("--cursor <c>", "Line-offset cursor from a previous page").option("--json", "Emit raw JSON instead of plain lines").action(cliAction(async (runId, opts) => {
+	runs.command("logs").argument("<runId>", RUN_ID_ARG_HELP).description("Print a page of a step log (admin API: /api/v1/admin/runs/:runId/jobs/:jobId/steps/:i/logs)").requiredOption("--job <jobId>", "Job id (the dispatch_queue row id for an eval round)").option("--step <n>", "Step index (default 0; -1 is the job setup log), or an init step as init[<n>]", "0").option("--limit <n>", "Max lines to return (default 500, server caps at 2000)", "500").option("--cursor <c>", "Line-offset cursor from a previous page").option("--json", "Emit raw JSON instead of plain lines").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
+		const stepIndex = await resolveStepRef(getClient(), runId, String(opts.job), opts.step);
 		const params = new URLSearchParams({ limit: String(opts.limit) });
 		if (opts.cursor) params.set("cursor", String(opts.cursor));
-		const path = `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs/${encodeURIComponent(String(opts.job))}/steps/${encodeURIComponent(String(opts.step))}/logs?${params.toString()}`;
+		const path = `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs/${encodeURIComponent(String(opts.job))}/steps/${encodeURIComponent(stepIndex)}/logs?${params.toString()}`;
 		const response = await getClient().get(path);
 		if (opts.json) {
 			console.log(JSON.stringify(response, null, 2));
@@ -19868,10 +20001,12 @@ function registerRunsCommands(program, getClient) {
 		}
 		for (const line of response.lines) console.log(line.value);
 		if (response.nextCursor) console.error(`(more: re-run with --cursor ${response.nextCursor})`);
-		const note = emptyStepLogNote(parseInt(String(opts.step), 10), response);
+		const initIndex = parseInitStepRef(String(opts.step));
+		const note = emptyStepLogNote(initIndex === void 0 ? parseInt(stepIndex, 10) : initStepLabel(initIndex), response);
 		if (note) console.error(note);
 	}));
-	runs.command("ephemeral-key <runId>").description("Show whether the run-ephemeral key has been scrubbed yet").option("--json", "Emit raw JSON instead of plain text").action(cliAction(async (runId, opts) => {
+	runs.command("ephemeral-key").argument("<runId>", RUN_ID_ARG_HELP).description("Show whether the run-ephemeral key has been scrubbed yet").option("--json", "Emit raw JSON instead of plain text").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		const response = await getClient().getRunEphemeralKey(runId);
 		if (opts.json) {
 			console.log(JSON.stringify(response, null, 2));
@@ -19885,7 +20020,8 @@ function registerRunsCommands(program, getClient) {
 			console.log(`created_at: -`);
 		}
 	}));
-	runs.command("secret-outputs <runId>").description("List per-job secret outputs (masked by default; --reveal decrypts and audits)").option("--output-key <key>", "Filter to a single output_key").option("--reveal", "Decrypt and print plaintext values. Audited with actor=secret-outputs.reveal; requires secret.reveal permission").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runId, opts) => {
+	runs.command("secret-outputs").argument("<runId>", RUN_ID_ARG_HELP).description("List per-job secret outputs (masked by default; --reveal decrypts and audits)").option("--output-key <key>", "Filter to a single output_key").option("--reveal", "Decrypt and print plaintext values. Audited with actor=secret-outputs.reveal; requires secret.reveal permission").option("--json", "Emit raw JSON instead of a table").action(cliAction(async (runRef, opts) => {
+		const runId = await resolveRunRef(getClient(), runRef);
 		if (opts.reveal) process.stderr.write("⚠  --reveal will decrypt secret values; this call is recorded in secret_audit_log.\n");
 		const response = await getClient().getRunSecretOutputs(runId, {
 			outputKey: opts.outputKey,
@@ -26820,7 +26956,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.20.0";
+	return "0.21.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -30530,6 +30666,16 @@ function registerQueueCommands(program, getClient) {
 }
 //#endregion
 //#region src/cli/commands/execution.ts
+/**
+* The full run id `execution show` was given. Over the admin API a prefix resolves
+* like `kici-admin runs show`; the direct-database path takes a full id only.
+*/
+async function resolveExecutionRunRef(ref, client) {
+	if (client) return resolveRunRef(client, ref);
+	const parsed = parseRunIdRef(ref);
+	if (parsed.kind === "uuid") return parsed.runId;
+	throw new Error(`Invalid run id '${ref}': --database-url needs a full run id. Drop --database-url to look up a prefix over the admin API ('kici-admin execution list' shows full run ids).`);
+}
 function printRunsTable(runs) {
 	if (runs.length === 0) {
 		console.log("No execution runs found.");
@@ -30601,8 +30747,9 @@ function registerExecutionCommands(program, getClient) {
 			printJsonOr(opts.json, result, (r) => printRunsTable(r.runs));
 		}
 	}));
-	exec.command("show <runId>").description("Show one run + its jobs (by run_id)").option(DIRECT_DB_URL_FLAG, DIRECT_DB_URL_HELP).option("--json", "Emit JSON output").action(cliAction(async (runId, opts) => {
+	exec.command("show <runId>").description("Show one run + its jobs (by run_id, or its first 4+ characters)").option(DIRECT_DB_URL_FLAG, DIRECT_DB_URL_HELP).option("--json", "Emit JSON output").action(cliAction(async (runRef, opts) => {
 		const dbUrl = resolveDirectDbUrl(opts.databaseUrl);
+		const runId = await resolveExecutionRunRef(runRef, dbUrl ? void 0 : getClient());
 		const result = dbUrl ? await showExecutionRunDirect(dbUrl, { runId }) : await getClient().get(`/api/v1/admin/executions/${encodeURIComponent(runId)}`);
 		printJsonOr(opts.json, result, (r) => printRunShow(r.run, r.jobs));
 	}));
@@ -37069,7 +37216,7 @@ function routeRootArgs(root, args) {
 * build entry; the fallback covers a source run (tests, `tsx`), the same shape
 * `server.ts` and `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.20.0";
+const CLI_VERSION = "0.21.0";
 /**
 * Root command whose option parsing first routes argv through
 * {@link routeRootArgs}: a leading `--version` prints the CLI version, and an
@@ -37092,7 +37239,7 @@ var KiciAdminProgram = class extends Command {
 */
 function buildProgram() {
 	const program = new KiciAdminProgram();
-	program.name("kici-admin").description("KiCI orchestrator admin CLI for managing config, secrets, and tokens").version(CLI_VERSION, `-V, ${ROOT_VERSION_FLAG}`, "output the version number (--version also works before a command)").option("-u, --url <url>", "Orchestrator URL", process.env.KICI_ADMIN_URL ?? DEFAULT_ADMIN_URL).option("-t, --token <token>", "Admin API token", process.env.KICI_ADMIN_TOKEN);
+	program.name("kici-admin").description("KiCI orchestrator admin CLI for managing config, secrets, and tokens").version(CLI_VERSION, `-V, ${ROOT_VERSION_FLAG}`, "output the version number (--version also works before a command)").addOption(new Option("-u, --url <url>", "Orchestrator URL").env("KICI_ADMIN_URL").default(DEFAULT_ADMIN_URL)).addOption(new Option("-t, --token <token>", "Admin API token").env("KICI_ADMIN_TOKEN"));
 	/** Lazy, so --help works without --token. */
 	function getClient() {
 		const opts = program.opts();