@kici-dev/orchestrator 0.3.0 → 0.5.0

package/dist/cli.js

@@ -6,11 +6,11 @@ import path, { dirname, join, resolve } from "node:path";
 import * as fs$1 from "node:fs";
 import fs, { chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, mkdirSync, mkdtempSync, openSync, promises, readFileSync, realpathSync, rmSync, statSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
 import { Command, Option } from "commander";
-import { AgentPlatform, BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createContextTemplateDirect, createDb, createDbRole, createLogger, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deriveKey, diagnoseExitCode, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, encrypt, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, kiciMkdtemp, listCheckRunTrackingDirect, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedContextBindingDirect, seedContextDirect, setContextPolicyDirect, setContextSecretDirect, sha256, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
+import { AgentPlatform, BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createContextTemplateDirect, createDb, createDbRole, createLogger, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deriveKey, diagnoseExitCode, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, encrypt, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, kiciMkdtemp, listCheckRunTrackingDirect, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedContextBindingDirect, seedContextDirect, serializeError, setContextPolicyDirect, setContextSecretDirect, sha256, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
+import { AccessLogSource, DEFAULT_APPROVAL_EXPIRY_HOURS, ExecutionJobStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, OrchestratorMode, PLATFORM_CONNECTED_MODES, PRIVILEGED_ROOT_LABEL, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, agentLabelOf, assertValidSecretKey, attestationVerifyStatusSchema, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseHostPropertyAssignments, scalerAgentLabels, scalerPlatformSchema, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve } from "@kici-dev/engine";
 import crypto$1, { createDecipheriv, createHash, createHmac, createPublicKey, generateKeyPairSync, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { createInterface } from "node:readline";
 import { sql } from "kysely";
-import { AccessLogSource, DEFAULT_APPROVAL_EXPIRY_HOURS, ExecutionJobStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, OrchestratorMode, PLATFORM_CONNECTED_MODES, PRIVILEGED_ROOT_LABEL, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, agentLabelOf, attestationVerifyStatusSchema, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseHostPropertyAssignments, scalerAgentLabels, scalerPlatformSchema, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve } from "@kici-dev/engine";
 import { access, chmod, constants as constants$1, copyFile, link, mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { parse, stringify } from "yaml";
 import { z } from "zod";
@@ -36,6 +36,7 @@ import { confirm, input, password, select } from "@inquirer/prompts";
 import JSZip from "jszip";
 import { pipeline } from "node:stream/promises";
 import { isCiEnvironment } from "@kici-dev/shared/ci-env";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { $ } from "zx";
 import "pg";
 import { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DashboardWriteCategory, DashboardWritePolicyState, DashboardWriteSensitivity } from "@kici-dev/engine/protocol/dashboard-write-operations";
@@ -783,17 +784,36 @@ var PgSecretStore = class PgSecretStore {
 		}
 		return result;
 	}
-	/**
-	* Set (create or update) a secret in a scope.
-	* Encrypts the value with AAD = "orgId:scope:key".
-	*/
 	/** Check if a scope is internal/operational (always allowed regardless of toggle). */
 	isInternalScope(scope) {
 		const colonIdx = scope.indexOf(":");
 		const path = colonIdx >= 0 ? scope.slice(colonIdx + 1) : scope;
 		return path.startsWith("__source__/") || path.startsWith("__webhook__/");
 	}
+	/**
+	* Set (create or update) a secret in a scope.
+	* Encrypts the value with AAD = "orgId:scope:key".
+	*
+	* Rejects a key outside `[A-Za-z0-9._-]` before doing anything else. The AAD
+	* is a plain concatenation, so a `:` in the key would let two distinct
+	* locations render one AAD (scope 'b' + key 'c:d' equals scope 'b:c' + key
+	* 'd') and a ciphertext written at one would authenticate at the other. The
+	* check sits ahead of the customerSecretsEnabled gate so internal scopes get
+	* no exemption — the binding has to hold for every writer.
+	*
+	* Callers pass a bare scope path, so the AAD's middle field is colon-free
+	* too: the admin route and the dashboard handler both run the scope
+	* validator immediately before calling in, and `source-store` builds its
+	* scope from a uuid. That precondition is what makes the whole triple
+	* recoverable, and it is the caller's to keep — this method does not
+	* re-check it.
+	*
+	* Write-path only: getSecrets, listKeys, deleteSecret, deleteScope,
+	* renameScope, getAllSecrets and createScope stay unvalidated, which is what
+	* keeps a key stored before this rule readable and deletable.
+	*/
 	async setSecret(orgId, scope, key, value) {
+		assertValidSecretKey(key);
 		if (!this.customerSecretsEnabled && !this.isInternalScope(scope)) throw new Error("PG customer secrets are disabled. Use an external secret backend or enable pgCustomerSecrets in config.");
 		const aad = `${orgId}:${scope}:${key}`;
 		const encrypted = encrypt(value, this.masterKey, this.keyVersion, aad);
@@ -1491,6 +1511,7 @@ function registerSecretCommands(program, getClient) {
 			}
 			const dbUrl = resolveDirectDbUrl$10(opts.databaseUrl);
 			if (dbUrl) {
+				assertValidSecretKey(key);
 				await setContextSecretDirect(dbUrl, {
 					orgId,
 					context: scope,
@@ -2492,8 +2513,8 @@ server:
 //#endregion
 //#region src/db/migrations/001_initial.ts
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$107,
-	up: () => up$107
+	down: () => down$114,
+	up: () => up$114
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -3185,7 +3206,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$107(db) {
+async function up$114(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -3207,7 +3228,7 @@ async function up$107(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$107(db) {
+async function down$114(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -3254,8 +3275,8 @@ async function down$107(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$106,
-	up: () => up$106
+	down: () => down$113,
+	up: () => up$113
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -3269,13 +3290,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$106(db) {
+async function up$113(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$106(db) {
+async function down$113(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -3284,8 +3305,8 @@ async function down$106(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$105,
-	up: () => up$105
+	down: () => down$112,
+	up: () => up$112
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -3309,7 +3330,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$105(db) {
+async function up$112(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -3347,28 +3368,28 @@ async function up$105(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$105(db) {
+async function down$112(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$104,
-	up: () => up$104
+	down: () => down$111,
+	up: () => up$111
 });
-async function up$104(db) {
+async function up$111(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$104(db) {
+async function down$111(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$103,
-	up: () => up$103
+	down: () => down$110,
+	up: () => up$110
 });
 /**
 * Cold-store chunk counter table.
@@ -3385,7 +3406,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$103(db) {
+async function up$110(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -3403,14 +3424,14 @@ async function up$103(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$103(db) {
+async function down$110(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$102,
-	up: () => up$102
+	down: () => down$109,
+	up: () => up$109
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -3446,7 +3467,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$102(db) {
+async function up$109(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -3491,7 +3512,7 @@ async function up$102(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$102(db) {
+async function down$109(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -3516,8 +3537,8 @@ async function down$102(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$101,
-	up: () => up$101
+	down: () => down$108,
+	up: () => up$108
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -3557,7 +3578,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$101(db) {
+async function up$108(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -3578,7 +3599,7 @@ async function up$101(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$101(db) {
+async function down$108(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -3606,8 +3627,8 @@ async function down$101(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$100,
-	up: () => up$100
+	down: () => down$107,
+	up: () => up$107
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -3645,7 +3666,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$100(db) {
+async function up$107(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -3661,7 +3682,7 @@ async function up$100(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$100(db) {
+async function down$107(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -3680,8 +3701,8 @@ async function down$100(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$99,
-	up: () => up$99
+	down: () => down$106,
+	up: () => up$106
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -3694,7 +3715,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$99(db) {
+async function up$106(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -3703,14 +3724,14 @@ async function up$99(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$99(db) {
+async function down$106(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$98,
-	up: () => up$98
+	down: () => down$105,
+	up: () => up$105
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -3742,7 +3763,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$98(db) {
+async function up$105(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -3769,14 +3790,14 @@ async function up$98(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$98(db) {
+async function down$105(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$97,
-	up: () => up$97
+	down: () => down$104,
+	up: () => up$104
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -3795,11 +3816,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$97(db) {
+async function up$104(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$97(db) {
+async function down$104(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3838,8 +3859,8 @@ async function down$97(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$96,
-	up: () => up$96
+	down: () => down$103,
+	up: () => up$103
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -3865,7 +3886,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$96(db) {
+async function up$103(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -3883,14 +3904,14 @@ async function up$96(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$96(db) {
+async function down$103(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$95,
-	up: () => up$95
+	down: () => down$102,
+	up: () => up$102
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -3909,7 +3930,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$95(db) {
+async function up$102(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -3919,15 +3940,15 @@ async function up$95(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$95(db) {
+async function down$102(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$94,
-	up: () => up$94
+	down: () => down$101,
+	up: () => up$101
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -3961,7 +3982,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$94(db) {
+async function up$101(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3992,7 +4013,7 @@ async function up$94(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$94(db) {
+async function down$101(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -4010,8 +4031,8 @@ async function down$94(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$93,
-	up: () => up$93
+	down: () => down$100,
+	up: () => up$100
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -4039,7 +4060,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$93(db) {
+async function up$100(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4164,7 +4185,7 @@ async function up$93(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$93(db) {
+async function down$100(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4189,8 +4210,8 @@ async function down$93(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$92,
-	up: () => up$92
+	down: () => down$99,
+	up: () => up$99
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -4203,7 +4224,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$92(db) {
+async function up$99(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4217,7 +4238,7 @@ async function up$92(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$92(db) {
+async function down$99(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -4225,8 +4246,8 @@ async function down$92(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$91,
-	up: () => up$91
+	down: () => down$98,
+	up: () => up$98
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -4266,17 +4287,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$91(db) {
+async function up$98(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$91(db) {
+async function down$98(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$90,
-	up: () => up$90
+	down: () => down$97,
+	up: () => up$97
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -4321,19 +4342,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$90(db) {
+async function up$97(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$90(db) {
+async function down$97(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$89,
-	up: () => up$89
+	down: () => down$96,
+	up: () => up$96
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -4356,7 +4377,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$89(db) {
+async function up$96(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -4377,15 +4398,15 @@ async function up$89(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$89(db) {
+async function down$96(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$88,
-	up: () => up$88
+	down: () => down$95,
+	up: () => up$95
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -4400,7 +4421,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$88(db) {
+async function up$95(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4414,7 +4435,7 @@ async function up$88(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$88(db) {
+async function down$95(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -4422,8 +4443,8 @@ async function down$88(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$87,
-	up: () => up$87
+	down: () => down$94,
+	up: () => up$94
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -4447,7 +4468,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$87(db) {
+async function up$94(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4478,14 +4499,14 @@ async function up$87(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$87(db) {
+async function down$94(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$86,
-	up: () => up$86
+	down: () => down$93,
+	up: () => up$93
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -4512,7 +4533,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$86(db) {
+async function up$93(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4562,7 +4583,7 @@ async function up$86(db) {
     `.execute(db);
 	}
 }
-async function down$86(db) {
+async function down$93(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -4570,8 +4591,8 @@ async function down$86(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$85,
-	up: () => up$85
+	down: () => down$92,
+	up: () => up$92
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -4595,7 +4616,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$85(db) {
+async function up$92(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4620,7 +4641,7 @@ async function up$85(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$85(db) {
+async function down$92(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -4632,8 +4653,8 @@ async function down$85(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$84,
-	up: () => up$84
+	down: () => down$91,
+	up: () => up$91
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -4649,7 +4670,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$84(db) {
+async function up$91(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4665,7 +4686,7 @@ async function up$84(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$84(db) {
+async function down$91(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -4673,8 +4694,8 @@ async function down$84(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$83,
-	up: () => up$83
+	down: () => down$90,
+	up: () => up$90
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -4688,7 +4709,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$83(db) {
+async function up$90(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4708,7 +4729,7 @@ async function up$83(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$83(db) {
+async function down$90(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -4719,8 +4740,8 @@ async function down$83(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$82,
-	up: () => up$82
+	down: () => down$89,
+	up: () => up$89
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -4729,7 +4750,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$82(db) {
+async function up$89(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -4739,7 +4760,7 @@ async function up$82(db) {
     ])))
   `.execute(db);
 }
-async function down$82(db) {
+async function down$89(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -4752,8 +4773,8 @@ async function down$82(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$81,
-	up: () => up$81
+	down: () => down$88,
+	up: () => up$88
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -4771,13 +4792,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$81(db) {
+async function up$88(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$81(db) {
+async function down$88(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -4785,8 +4806,8 @@ async function down$81(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$80,
-	up: () => up$80
+	down: () => down$87,
+	up: () => up$87
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -4805,7 +4826,7 @@ var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has either column skips it.
 */
-async function columnExists$6(db, column) {
+async function columnExists$11(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4815,17 +4836,17 @@ async function columnExists$6(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$80(db) {
-	if (!await columnExists$6(db, "user_cache_quota_bytes")) await sql`
+async function up$87(db) {
+	if (!await columnExists$11(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
     `.execute(db);
-	if (!await columnExists$6(db, "user_cache_ttl_ms")) await sql`
+	if (!await columnExists$11(db, "user_cache_ttl_ms")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$80(db) {
+async function down$87(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -4836,8 +4857,8 @@ async function down$80(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$79,
-	up: () => up$79
+	down: () => down$86,
+	up: () => up$86
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -4851,7 +4872,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$79(db) {
+async function up$86(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4864,7 +4885,7 @@ async function up$79(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$79(db) {
+async function down$86(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -4872,8 +4893,8 @@ async function down$79(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$78,
-	up: () => up$78
+	down: () => down$85,
+	up: () => up$85
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -4884,14 +4905,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$78(db) {
+async function up$85(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$78(db) {
+async function down$85(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -4901,8 +4922,8 @@ async function down$78(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$77,
-	up: () => up$77
+	down: () => down$84,
+	up: () => up$84
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -4919,7 +4940,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$77(db) {
+async function up$84(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4944,7 +4965,7 @@ async function up$77(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$77(db) {
+async function down$84(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4952,8 +4973,8 @@ async function down$77(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$76,
-	up: () => up$76
+	down: () => down$83,
+	up: () => up$83
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4965,7 +4986,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$76(db) {
+async function up$83(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4979,7 +5000,7 @@ async function up$76(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$76(db) {
+async function down$83(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4987,8 +5008,8 @@ async function down$76(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$75,
-	up: () => up$75
+	down: () => down$82,
+	up: () => up$82
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -5005,7 +5026,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$75(db) {
+async function up$82(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -5025,7 +5046,7 @@ async function up$75(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$75(db) {
+async function down$82(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -5036,8 +5057,8 @@ async function down$75(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$74,
-	up: () => up$74
+	down: () => down$81,
+	up: () => up$81
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -5059,7 +5080,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$74(db) {
+async function up$81(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -5092,7 +5113,7 @@ async function up$74(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$74(db) {
+async function down$81(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -5102,8 +5123,8 @@ async function down$74(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$73,
-	up: () => up$73
+	down: () => down$80,
+	up: () => up$80
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -5112,7 +5133,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$73(db) {
+async function up$80(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -5122,14 +5143,14 @@ async function up$73(db) {
     )
   `.execute(db);
 }
-async function down$73(db) {
+async function down$80(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$72,
-	up: () => up$72
+	down: () => down$79,
+	up: () => up$79
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -5142,7 +5163,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$72(db) {
+async function up$79(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5168,14 +5189,14 @@ async function up$72(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$72(db) {
+async function down$79(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$71,
-	up: () => up$71
+	down: () => down$78,
+	up: () => up$78
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -5192,7 +5213,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$71(db) {
+async function up$78(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -5208,7 +5229,7 @@ async function up$71(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$71(db) {
+async function down$78(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -5227,8 +5248,8 @@ async function down$71(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$70,
-	up: () => up$70
+	down: () => down$77,
+	up: () => up$77
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -5240,7 +5261,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$70(db) {
+async function up$77(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5259,14 +5280,14 @@ async function up$70(db) {
     )
   `.execute(db);
 }
-async function down$70(db) {
+async function down$77(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$69,
-	up: () => up$69
+	down: () => down$76,
+	up: () => up$76
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -5283,7 +5304,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$69(db) {
+async function up$76(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -5313,14 +5334,14 @@ async function up$69(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$69(db) {
+async function down$76(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$68,
-	up: () => up$68
+	down: () => down$75,
+	up: () => up$75
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -5337,7 +5358,7 @@ var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has any column is a no-op.
 */
-async function colExists$12(db, table, name) {
+async function colExists$13(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5347,18 +5368,18 @@ async function colExists$12(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$68(db) {
-	if (!await colExists$12(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
-	if (!await colExists$12(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
-	if (!await colExists$12(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
-	if (!await colExists$12(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
+async function up$75(db) {
+	if (!await colExists$13(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
+	if (!await colExists$13(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
+	if (!await colExists$13(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
+	if (!await colExists$13(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_pinned_agent
       ON public.dispatch_queue (pinned_agent_id)
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$68(db) {
+async function down$75(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -5368,8 +5389,8 @@ async function down$68(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$67,
-	up: () => up$67
+	down: () => down$74,
+	up: () => up$74
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -5389,7 +5410,7 @@ var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$11(db, table, name) {
+async function colExists$12(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5399,16 +5420,16 @@ async function colExists$11(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$67(db) {
-	if (!await colExists$11(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
-	if (!await colExists$11(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
-	if (!await colExists$11(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
+async function up$74(db) {
+	if (!await colExists$12(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
+	if (!await colExists$12(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
+	if (!await colExists$12(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_execution_jobs_wave
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$67(db) {
+async function down$74(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -5417,8 +5438,8 @@ async function down$67(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$66,
-	up: () => up$66
+	down: () => down$73,
+	up: () => up$73
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -5434,7 +5455,7 @@ var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$10(db, table, name) {
+async function colExists$11(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5444,19 +5465,19 @@ async function colExists$10(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$66(db) {
-	if (!await colExists$10(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
-	if (!await colExists$10(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+async function up$73(db) {
+	if (!await colExists$11(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+	if (!await colExists$11(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$66(db) {
+async function down$73(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$65,
-	up: () => up$65
+	down: () => down$72,
+	up: () => up$72
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -5467,7 +5488,7 @@ var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function colExists$9(db, table, name) {
+async function colExists$10(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5477,17 +5498,17 @@ async function colExists$9(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$65(db) {
-	if (!await colExists$9(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
+async function up$72(db) {
+	if (!await colExists$10(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$65(db) {
+async function down$72(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$64,
-	up: () => up$64
+	down: () => down$71,
+	up: () => up$71
 });
 /**
 * Add idempotent check-mode columns:
@@ -5504,7 +5525,7 @@ var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
 * All nullable. Idempotent: re-running on a DB that already has the columns is
 * a no-op.
 */
-async function colExists$8(db, table, name) {
+async function colExists$9(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5514,13 +5535,13 @@ async function colExists$8(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$64(db) {
-	if (!await colExists$8(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
-	if (!await colExists$8(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
-	if (!await colExists$8(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
-	if (!await colExists$8(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
+async function up$71(db) {
+	if (!await colExists$9(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
+	if (!await colExists$9(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
+	if (!await colExists$9(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
+	if (!await colExists$9(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$64(db) {
+async function down$71(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -5529,8 +5550,8 @@ async function down$64(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$63,
-	up: () => up$63
+	down: () => down$70,
+	up: () => up$70
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -5544,18 +5565,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive column).
 */
-async function up$63(db) {
+async function up$70(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$63(db) {
+async function down$70(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$62,
-	up: () => up$62
+	down: () => down$69,
+	up: () => up$69
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -5570,18 +5591,18 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive nullable column).
 */
-async function up$62(db) {
+async function up$69(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$62(db) {
+async function down$69(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$61,
-	up: () => up$61
+	down: () => down$68,
+	up: () => up$68
 });
 /**
 * Migrate `execution_job_needs` from the binary `if_failed` policy to a
@@ -5606,7 +5627,7 @@ const ALL_TERMINAL_JSON = JSON.stringify([
 	"drift_dropped"
 ]);
 const SUCCESS_ONLY_JSON = JSON.stringify(["success"]);
-async function colExists$7(db, table, name) {
+async function colExists$8(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5617,12 +5638,12 @@ async function colExists$7(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
-async function up$61(db) {
-	if (!await colExists$7(db, "execution_job_needs", "run_on")) await sql`
+async function up$68(db) {
+	if (!await colExists$8(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
     `.execute(db);
-	if (await colExists$7(db, "execution_job_needs", "if_failed")) {
+	if (await colExists$8(db, "execution_job_needs", "if_failed")) {
 		await sql`
       UPDATE public.execution_job_needs
          SET run_on = ${ALL_TERMINAL_JSON}
@@ -5636,12 +5657,12 @@ async function up$61(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$61(db) {
-	if (!await colExists$7(db, "execution_job_needs", "if_failed")) await sql`
+async function down$68(db) {
+	if (!await colExists$8(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
     `.execute(db);
-	if (await colExists$7(db, "execution_job_needs", "run_on")) {
+	if (await colExists$8(db, "execution_job_needs", "run_on")) {
 		await sql`
       UPDATE public.execution_job_needs
          SET if_failed = CASE WHEN run_on = ${SUCCESS_ONLY_JSON} THEN 'skip' ELSE 'run' END
@@ -5652,8 +5673,8 @@ async function down$61(db) {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$60,
-	up: () => up$60
+	down: () => down$67,
+	up: () => up$67
 });
 /**
 * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
@@ -5670,18 +5691,18 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$60(db) {
+async function up$67(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$60(db) {
+async function down$67(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$59,
-	up: () => up$59
+	down: () => down$66,
+	up: () => up$66
 });
 /**
 * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
@@ -5693,18 +5714,18 @@ var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$59(db) {
+async function up$66(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$59(db) {
+async function down$66(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$58,
-	up: () => up$58
+	down: () => down$65,
+	up: () => up$65
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -5719,18 +5740,18 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$58(db) {
+async function up$65(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down$58(db) {
+async function down$65(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/051_binding_host_pattern.ts
 var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$57,
-	up: () => up$57
+	down: () => down$64,
+	up: () => up$64
 });
 /**
 * Add a per-host dimension to environment secret bindings:
@@ -5746,7 +5767,7 @@ var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has the column / index is a no-op.
 * Additive — staging data is preserved.
 */
-async function up$57(db) {
+async function up$64(db) {
 	await sql`ALTER TABLE public.environment_bindings
     ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
@@ -5754,7 +5775,7 @@ async function up$57(db) {
 	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
     ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
 }
-async function down$57(db) {
+async function down$64(db) {
 	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
     DROP COLUMN IF EXISTS host_pattern`.execute(db);
@@ -5764,8 +5785,8 @@ async function down$57(db) {
 //#endregion
 //#region src/db/migrations/052_host_reach_metadata.ts
 var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$56,
-	up: () => up$56
+	down: () => down$63,
+	up: () => up$63
 });
 /**
 * Add pre-agent reach metadata to the host roster so a declared host (no agent
@@ -5782,14 +5803,14 @@ var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
 * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
 * so staging data is preserved.
 */
-async function up$56(db) {
+async function up$63(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS address text,
     ADD COLUMN IF NOT EXISTS ssh_user text,
     ADD COLUMN IF NOT EXISTS ssh_port integer,
     ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
 }
-async function down$56(db) {
+async function down$63(db) {
 	await sql`ALTER TABLE public.host_roster
     DROP COLUMN IF EXISTS address,
     DROP COLUMN IF EXISTS ssh_user,
@@ -5799,8 +5820,8 @@ async function down$56(db) {
 //#endregion
 //#region src/db/migrations/053_agent_token_single_use.ts
 var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$55,
-	up: () => up$55
+	down: () => down$62,
+	up: () => up$62
 });
 /**
 * Add a single-use marker to agent tokens for the bootstrap (init-runner)
@@ -5815,19 +5836,19 @@ var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$55(db) {
+async function up$62(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
 }
-async function down$55(db) {
+async function down$62(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS consumed_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/054_local_working_tree.ts
 var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$54,
-	up: () => up$54
+	down: () => down$61,
+	up: () => up$61
 });
 /**
 * Mark runs that executed an uploaded local working tree (`kici run remote`):
@@ -5840,19 +5861,19 @@ var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
 * data is preserved.
 */
-async function up$54(db) {
+async function up$61(db) {
 	await sql`ALTER TABLE public.execution_runs
     ADD COLUMN IF NOT EXISTS local_working_tree boolean NOT NULL DEFAULT false`.execute(db);
 }
-async function down$54(db) {
+async function down$61(db) {
 	await sql`ALTER TABLE public.execution_runs
     DROP COLUMN IF EXISTS local_working_tree`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/055_agent_token_mandatory_labels.ts
 var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$53,
-	up: () => up$53
+	down: () => down$60,
+	up: () => up$60
 });
 /**
 * Add a token-bound mandatory-label taint to agent tokens:
@@ -5868,19 +5889,19 @@ var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$53(db) {
+async function up$60(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS mandatory_labels text`.execute(db);
 }
-async function down$53(db) {
+async function down$60(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS mandatory_labels`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/056_execution_jobs_environments.ts
 var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$52,
-	up: () => up$52
+	down: () => down$59,
+	up: () => up$59
 });
 /**
 * Add a per-job bound deployment-environment list to `execution_jobs`:
@@ -5895,19 +5916,19 @@ var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$52(db) {
+async function up$59(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS environments text`.execute(db);
 }
-async function down$52(db) {
+async function down$59(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS environments`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/057_step_concurrency.ts
 var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$51,
-	up: () => up$51
+	down: () => down$58,
+	up: () => up$58
 });
 /**
 * Add parallel step-group concurrency columns to `execution_steps`:
@@ -5920,7 +5941,7 @@ var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
 * Both nullable, no backfill. Idempotent: re-running on a DB that already has the
 * columns is a no-op.
 */
-async function colExists$6(db, table, name) {
+async function colExists$7(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5930,19 +5951,19 @@ async function colExists$6(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$51(db) {
-	if (!await colExists$6(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
-	if (!await colExists$6(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
+async function up$58(db) {
+	if (!await colExists$7(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
+	if (!await colExists$7(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
 }
-async function down$51(db) {
+async function down$58(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/058_access_log_agent_label.ts
 var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$50,
-	up: () => up$50
+	down: () => down$57,
+	up: () => up$57
 });
 /**
 * Add `access_log.agent_label text` — the human-set name of the agent that
@@ -5952,7 +5973,7 @@ var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
 * the access log by agent. NULL for ordinary human / API-key / system actors.
 * Nullable, no backfill. Idempotent.
 */
-async function colExists$5(db, table, name) {
+async function colExists$6(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5962,17 +5983,17 @@ async function colExists$5(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$50(db) {
-	if (!await colExists$5(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
+async function up$57(db) {
+	if (!await colExists$6(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
 }
-async function down$50(db) {
+async function down$57(db) {
 	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/059_attestation_verdict.ts
 var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$56,
+	up: () => up$56
 });
 /**
 * Add server-side verification verdict columns to `attestations`, plus the
@@ -5989,7 +6010,7 @@ var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on the `verify_status` column's existence.
 */
-async function colExists$4(db, table, name) {
+async function colExists$5(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -5999,8 +6020,8 @@ async function colExists$4(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$49(db) {
-	if (await colExists$4(db, "attestations", "verify_status")) return;
+async function up$56(db) {
+	if (await colExists$5(db, "attestations", "verify_status")) return;
 	await sql`
     ALTER TABLE public.attestations
       ADD COLUMN verify_status TEXT NOT NULL DEFAULT 'pending',
@@ -6012,7 +6033,7 @@ async function up$49(db) {
 	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
 	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
 }
-async function down$49(db) {
+async function down$56(db) {
 	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
 	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
@@ -6027,8 +6048,8 @@ async function down$49(db) {
 //#endregion
 //#region src/db/migrations/060_run_trigger_actor.ts
 var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$55,
+	up: () => up$55
 });
 /**
 * Add the triggering-actor columns to `execution_runs`:
@@ -6046,7 +6067,7 @@ var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
 * @x" and audit, beyond actor notifications. All nullable, no backfill,
 * idempotent.
 */
-async function colExists$3(db, table, name) {
+async function colExists$4(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6056,12 +6077,12 @@ async function colExists$3(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$48(db) {
-	if (!await colExists$3(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
-	if (!await colExists$3(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
-	if (!await colExists$3(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
+async function up$55(db) {
+	if (!await colExists$4(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
+	if (!await colExists$4(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
+	if (!await colExists$4(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
 }
-async function down$48(db) {
+async function down$55(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
@@ -6069,8 +6090,8 @@ async function down$48(db) {
 //#endregion
 //#region src/db/migrations/061_execution_runs_environment_id.ts
 var _061_execution_runs_environment_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$54,
+	up: () => up$54
 });
 /**
 * Add `environment_id` to `execution_runs` so environment run-history can be
@@ -6096,7 +6117,7 @@ var _061_execution_runs_environment_id_exports = /* @__PURE__ */ __exportAll({
 * backfill use `IF NOT EXISTS` / `WHERE environment_id IS NULL` so re-running is
 * a no-op.
 */
-async function colExists$2(db, table, name) {
+async function colExists$3(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6106,8 +6127,8 @@ async function colExists$2(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$47(db) {
-	if (!await colExists$2(db, "execution_runs", "environment_id")) await sql`
+async function up$54(db) {
+	if (!await colExists$3(db, "execution_runs", "environment_id")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN environment_id uuid
         REFERENCES public.environments(id) ON DELETE SET NULL
@@ -6128,15 +6149,15 @@ async function up$47(db) {
              WHERE e2.type = 'fixed' AND e2.name = er.environment) = 1
   `.execute(db);
 }
-async function down$47(db) {
+async function down$54(db) {
 	await sql`DROP INDEX IF EXISTS idx_execution_runs_environment_id`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS environment_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/062_execution_runs_agent_label.ts
 var _062_execution_runs_agent_label_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$53,
+	up: () => up$53
 });
 /**
 * Add the agent-provenance columns to `execution_runs`:
@@ -6151,7 +6172,7 @@ var _062_execution_runs_agent_label_exports = /* @__PURE__ */ __exportAll({
 * permissions). NULL for ordinary human / webhook / system-driven runs.
 * Nullable, no backfill, idempotent.
 */
-async function colExists$1(db, table, name) {
+async function colExists$2(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6161,19 +6182,19 @@ async function colExists$1(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$46(db) {
-	if (!await colExists$1(db, "execution_runs", "triggered_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN triggered_by_agent_label text`.execute(db);
-	if (!await colExists$1(db, "execution_runs", "cancelled_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN cancelled_by_agent_label text`.execute(db);
+async function up$53(db) {
+	if (!await colExists$2(db, "execution_runs", "triggered_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN triggered_by_agent_label text`.execute(db);
+	if (!await colExists$2(db, "execution_runs", "cancelled_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN cancelled_by_agent_label text`.execute(db);
 }
-async function down$46(db) {
+async function down$53(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS triggered_by_agent_label`.execute(db);
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelled_by_agent_label`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/063_access_log_agent_label_index.ts
 var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * Index `access_log.agent_label` (column added by migration 058) so the
@@ -6181,17 +6202,17 @@ var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
 * the dashboard "agent name" filter) does an indexed exact-match lookup
 * instead of a scan. Idempotent.
 */
-async function up$45(db) {
+async function up$52(db) {
 	await sql`CREATE INDEX IF NOT EXISTS access_log_agent_label_idx ON public.access_log (agent_label)`.execute(db);
 }
-async function down$45(db) {
+async function down$52(db) {
 	await sql`DROP INDEX IF EXISTS access_log_agent_label_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/064_execution_jobs_skipped_environments.ts
 var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Add the test-run skipped-environment columns to `execution_jobs`:
@@ -6206,13 +6227,13 @@ var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportA
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$44(db) {
+async function up$51(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS skipped_environments text`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS env_warning text`.execute(db);
 }
-async function down$44(db) {
+async function down$51(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS skipped_environments`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs
@@ -6221,8 +6242,8 @@ async function down$44(db) {
 //#endregion
 //#region src/db/migrations/065_pending_attestations.ts
 var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Add the `pending_attestations` deferred-attestation outbox and an idempotency
@@ -6242,7 +6263,7 @@ var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$43(db) {
+async function up$50(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -6281,15 +6302,15 @@ async function up$43(db) {
       ON public.attestations (run_id, job_id, subject_digest)
   `.execute(db);
 }
-async function down$43(db) {
+async function down$50(db) {
 	await sql`DROP INDEX IF EXISTS uq_attestations_run_job_subject`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.pending_attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/066_pending_attestations_rejected.ts
 var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
@@ -6300,21 +6321,21 @@ var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$42(db) {
-	if (await columnExists$5(db, "pending_attestations", "rejected_at")) return;
+async function up$49(db) {
+	if (await columnExists$10(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
       ADD COLUMN rejected_at TIMESTAMPTZ
   `.execute(db);
 }
-async function down$42(db) {
-	if (!await columnExists$5(db, "pending_attestations", "rejected_at")) return;
+async function down$49(db) {
+	if (!await columnExists$10(db, "pending_attestations", "rejected_at")) return;
 	await sql`
     ALTER TABLE public.pending_attestations
       DROP COLUMN rejected_at
   `.execute(db);
 }
-async function columnExists$5(db, table, column) {
+async function columnExists$10(db, table, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6325,8 +6346,8 @@ async function columnExists$5(db, table, column) {
 //#endregion
 //#region src/db/migrations/067_environments_to_contexts.ts
 var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Rename the named-policy object from "environment" to "context" across the
@@ -6360,7 +6381,7 @@ var _067_environments_to_contexts_exports = /* @__PURE__ */ __exportAll({
 * columns automatically (Postgres references them by identity, not name), so
 * only the one hand-named index above needs an explicit rename.
 */
-async function up$41(db) {
+async function up$48(db) {
 	await sql`ALTER TABLE public.environments RENAME TO contexts`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings RENAME TO context_bindings`.execute(db);
 	await sql`ALTER TABLE public.environment_variables RENAME TO context_variables`.execute(db);
@@ -6379,7 +6400,7 @@ async function up$41(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'context'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'context'`.execute(db);
 }
-async function down$41(db) {
+async function down$48(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN trigger_source SET DEFAULT 'environment'`.execute(db);
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN queue_type SET DEFAULT 'environment'`.execute(db);
 	await sql`UPDATE public.held_runs SET trigger_source = 'environment' WHERE trigger_source = 'context'`.execute(db);
@@ -6401,8 +6422,8 @@ async function down$41(db) {
 //#endregion
 //#region src/db/migrations/068_request_idempotency.ts
 var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Add the `request_idempotency` claim table: a `request_id`-keyed record that
@@ -6417,12 +6438,12 @@ var _068_request_idempotency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$40(db) {
+async function up$47(db) {
 	if (await tableExists$3(db, "request_idempotency")) return;
 	await db.schema.createTable("request_idempotency").addColumn("request_id", "text", (c) => c.primaryKey()).addColumn("new_run_id", "text", (c) => c.notNull()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).execute();
 	await db.schema.createIndex("idx_request_idempotency_created_at").on("request_idempotency").column("created_at").execute();
 }
-async function down$40(db) {
+async function down$47(db) {
 	await db.schema.dropTable("request_idempotency").ifExists().execute();
 }
 async function tableExists$3(db, table) {
@@ -6436,8 +6457,8 @@ async function tableExists$3(db, table) {
 //#endregion
 //#region src/db/migrations/069_reroute_tunables.ts
 var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * Add the three reroute-tunable columns to `org_settings` (all nullable):
@@ -6456,12 +6477,12 @@ var _069_reroute_tunables_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: each column add is guarded on column existence, so a re-run on a
 * DB that already has a column is a no-op for that column.
 */
-async function up$39(db) {
+async function up$46(db) {
 	await addColumnIfMissing(db, "reroute_spawn_window_ms", "BIGINT");
 	await addColumnIfMissing(db, "reroute_ack_timeout_ms", "BIGINT");
 	await addColumnIfMissing(db, "reroute_max_hops", "INTEGER");
 }
-async function down$39(db) {
+async function down$46(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_spawn_window_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_ack_timeout_ms`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS reroute_max_hops`.execute(db);
@@ -6480,8 +6501,8 @@ async function addColumnIfMissing(db, column, type) {
 //#endregion
 //#region src/db/migrations/070_execution_runs_failure_class.ts
 var _070_execution_runs_failure_class_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Add `execution_runs.failure_class` — the reason a terminal run failed
@@ -6492,7 +6513,7 @@ var _070_execution_runs_failure_class_exports = /* @__PURE__ */ __exportAll({
 * like `status`. NULL for success / not-yet-terminal runs. Nullable, no backfill,
 * idempotent.
 */
-async function colExists(db, table, name) {
+async function colExists$1(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6502,17 +6523,17 @@ async function colExists(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$38(db) {
-	if (!await colExists(db, "execution_runs", "failure_class")) await sql`ALTER TABLE public.execution_runs ADD COLUMN failure_class text`.execute(db);
+async function up$45(db) {
+	if (!await colExists$1(db, "execution_runs", "failure_class")) await sql`ALTER TABLE public.execution_runs ADD COLUMN failure_class text`.execute(db);
 }
-async function down$38(db) {
+async function down$45(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS failure_class`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/071_batch_accumulation.ts
 var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * Add the batch-accumulation tables that back the `workflows_failed_batch`
@@ -6536,7 +6557,7 @@ var _071_batch_accumulation_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$37(db) {
+async function up$44(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -6581,15 +6602,15 @@ async function up$37(db) {
       ON public.batch_accumulation_items (window_id)
   `.execute(db);
 }
-async function down$37(db) {
+async function down$44(db) {
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_items`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.batch_accumulation_windows`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/072_dispatch_queue_run_id_index.ts
 var _072_dispatch_queue_run_id_index_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * Add `idx_dispatch_queue_run_id` on `dispatch_queue (run_id)`.
@@ -6602,20 +6623,20 @@ var _072_dispatch_queue_run_id_index_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
 */
-async function up$36(db) {
+async function up$43(db) {
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_run_id
       ON public.dispatch_queue (run_id)
   `.execute(db);
 }
-async function down$36(db) {
+async function down$43(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_run_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/073_org_settings_ingest_concurrency.ts
 var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Add `org_settings.ingest_max_concurrency BIGINT` (nullable).
@@ -6626,7 +6647,7 @@ var _073_org_settings_ingest_concurrency_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$35(db) {
+async function up$42(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6640,7 +6661,7 @@ async function up$35(db) {
       ADD COLUMN ingest_max_concurrency BIGINT
   `.execute(db);
 }
-async function down$35(db) {
+async function down$42(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS ingest_max_concurrency
   `.execute(db);
@@ -6648,8 +6669,8 @@ async function down$35(db) {
 //#endregion
 //#region src/db/migrations/074_normalize_zero_concurrency_limit.ts
 var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Normalize degenerate context concurrency limits. A `concurrency_limit` of 0
@@ -6660,15 +6681,15 @@ var _074_normalize_zero_concurrency_limit_exports = /* @__PURE__ */ __exportAll(
 * Idempotent; down() is a no-op (a normalized 0 cannot — and should not — be
 * restored).
 */
-async function up$34(db) {
+async function up$41(db) {
 	await sql`UPDATE public.contexts SET concurrency_limit = NULL WHERE concurrency_limit <= 0`.execute(db);
 }
-async function down$34(_db) {}
+async function down$41(_db) {}
 //#endregion
 //#region src/db/migrations/075_ingest_overflow_buffer.ts
 var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Durable overflow buffer for shed webhook-ingest deliveries.
@@ -6682,7 +6703,7 @@ var _075_ingest_overflow_buffer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$33(db) {
+async function up$40(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -6715,14 +6736,14 @@ async function up$33(db) {
       ON public.ingest_overflow_buffer (delivery_id)
   `.execute(db);
 }
-async function down$33(db) {
+async function down$40(db) {
 	await sql`DROP TABLE IF EXISTS public.ingest_overflow_buffer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/076_artifacts.ts
 var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Add the `artifacts` table for user-facing build artifacts and the per-org
@@ -6739,7 +6760,7 @@ var _076_artifacts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table / columns is a no-op.
 */
-async function up$32(db) {
+async function up$39(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -6775,7 +6796,7 @@ async function up$32(db) {
       ADD COLUMN IF NOT EXISTS artifact_ttl_ms BIGINT
   `.execute(db);
 }
-async function down$32(db) {
+async function down$39(db) {
 	await sql`DROP TABLE IF EXISTS public.artifacts`.execute(db);
 	await sql`
     ALTER TABLE public.org_settings
@@ -6786,8 +6807,8 @@ async function down$32(db) {
 //#endregion
 //#region src/db/migrations/077_backup_runs.ts
 var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Add the `backup_runs` table: one row per successful `kici-admin db backup`,
@@ -6798,12 +6819,12 @@ var _077_backup_runs_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$31(db) {
+async function up$38(db) {
 	if (await tableExists$2(db, "backup_runs")) return;
 	await db.schema.createTable("backup_runs").addColumn("id", "bigserial", (c) => c.primaryKey()).addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("dump_path", "text", (c) => c.notNull()).addColumn("byte_size", "bigint", (c) => c.notNull()).addColumn("secret_key_version", "integer").addColumn("pg_server_version", "text", (c) => c.notNull()).addColumn("migrations_hash", "text", (c) => c.notNull()).addColumn("hostname", "text", (c) => c.notNull()).execute();
 	await db.schema.createIndex("idx_backup_runs_created_at").on("backup_runs").column("created_at").execute();
 }
-async function down$31(db) {
+async function down$38(db) {
 	await db.schema.dropTable("backup_runs").ifExists().execute();
 }
 async function tableExists$2(db, table) {
@@ -6817,8 +6838,8 @@ async function tableExists$2(db, table) {
 //#endregion
 //#region src/db/migrations/078_org_settings_backup_staleness.ts
 var _078_org_settings_backup_staleness_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add the nullable `org_settings.backup_staleness_warn_hours INTEGER` column:
@@ -6828,7 +6849,7 @@ var _078_org_settings_backup_staleness_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on column existence.
 */
-async function up$30(db) {
+async function up$37(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6842,7 +6863,7 @@ async function up$30(db) {
       ADD COLUMN backup_staleness_warn_hours INTEGER
   `.execute(db);
 }
-async function down$30(db) {
+async function down$37(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS backup_staleness_warn_hours
   `.execute(db);
@@ -6850,8 +6871,8 @@ async function down$30(db) {
 //#endregion
 //#region src/db/migrations/079_org_settings_scaler_spawn_timeout.ts
 var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Add `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable).
@@ -6863,7 +6884,7 @@ var _079_org_settings_scaler_spawn_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$29(db) {
+async function up$36(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6877,7 +6898,7 @@ async function up$29(db) {
       ADD COLUMN scaler_spawn_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$29(db) {
+async function down$36(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS scaler_spawn_timeout_ms
   `.execute(db);
@@ -6885,8 +6906,8 @@ async function down$29(db) {
 //#endregion
 //#region src/db/migrations/080_cluster_settings.ts
 var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Create `cluster_settings`: a single-row (id='default') table of fleet-wide
@@ -6901,7 +6922,7 @@ var _080_cluster_settings_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$28(db) {
+async function up$35(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -6925,14 +6946,14 @@ async function up$28(db) {
     )
   `.execute(db);
 }
-async function down$28(db) {
+async function down$35(db) {
 	await sql`DROP TABLE IF EXISTS public.cluster_settings`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/081_org_settings_queue_timeout.ts
 var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Add `org_settings.queue_timeout_ms BIGINT` (nullable).
@@ -6949,7 +6970,7 @@ var _081_org_settings_queue_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$27(db) {
+async function up$34(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -6963,7 +6984,7 @@ async function up$27(db) {
       ADD COLUMN queue_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$27(db) {
+async function down$34(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS queue_timeout_ms
   `.execute(db);
@@ -6971,8 +6992,8 @@ async function down$27(db) {
 //#endregion
 //#region src/db/migrations/082_host_s3_reachable.ts
 var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Add `host_roster.s3_reachable BOOLEAN` (nullable).
@@ -6986,7 +7007,7 @@ var _082_host_s3_reachable_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$26(db) {
+async function up$33(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7000,7 +7021,7 @@ async function up$26(db) {
       ADD COLUMN s3_reachable BOOLEAN
   `.execute(db);
 }
-async function down$26(db) {
+async function down$33(db) {
 	await sql`
     ALTER TABLE public.host_roster DROP COLUMN IF EXISTS s3_reachable
   `.execute(db);
@@ -7008,8 +7029,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/083_org_settings_artifact_caps.ts
 var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Add `org_settings.artifact_max_bytes` + `artifact_max_per_run` (both nullable
@@ -7025,7 +7046,7 @@ var _083_org_settings_artifact_caps_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has a
 * column is a no-op.
 */
-async function up$25(db) {
+async function up$32(db) {
 	for (const col of ["artifact_max_bytes", "artifact_max_per_run"]) {
 		if ((await sql`
       SELECT EXISTS (
@@ -7038,15 +7059,15 @@ async function up$25(db) {
 		await sql`ALTER TABLE public.org_settings ADD COLUMN ${sql.ref(col)} BIGINT`.execute(db);
 	}
 }
-async function down$25(db) {
+async function down$32(db) {
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_bytes`.execute(db);
 	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS artifact_max_per_run`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/084_orchestrator_signing_keys.ts
 var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add the `orchestrator_signing_keys` table: the cluster-scoped, long-lived
@@ -7064,12 +7085,12 @@ var _084_orchestrator_signing_keys_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$24(db) {
+async function up$31(db) {
 	if (await tableExists$1(db, "orchestrator_signing_keys")) return;
 	await db.schema.createTable("orchestrator_signing_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_jwk", "text").addColumn("key_version", "integer", (c) => c.notNull().defaultTo(1)).addColumn("alg", "text", (c) => c.notNull()).addColumn("signer_kind", "text", (c) => c.notNull()).addColumn("key_ref", "text").addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("retired_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_orch_signing_keys_status").on("orchestrator_signing_keys").column("status").execute();
 }
-async function down$24(db) {
+async function down$31(db) {
 	await db.schema.dropTable("orchestrator_signing_keys").ifExists().execute();
 }
 async function tableExists$1(db, table) {
@@ -7083,8 +7104,8 @@ async function tableExists$1(db, table) {
 //#endregion
 //#region src/db/migrations/085_cluster_settings_reroute_flap_grace_ms.ts
 var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add `cluster_settings.reroute_flap_grace_ms` (nullable BIGINT).
@@ -7094,7 +7115,7 @@ var _085_cluster_settings_reroute_flap_grace_ms_exports = /* @__PURE__ */ __expo
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$23(db) {
+async function up$30(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7105,14 +7126,14 @@ async function up$23(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN reroute_flap_grace_ms BIGINT`.execute(db);
 }
-async function down$23(db) {
+async function down$30(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS reroute_flap_grace_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/086_cluster_settings_max_fanout_hosts.ts
 var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `cluster_settings.max_fanout_hosts` (nullable INTEGER).
@@ -7122,7 +7143,7 @@ var _086_cluster_settings_max_fanout_hosts_exports = /* @__PURE__ */ __exportAll
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$22(db) {
+async function up$29(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7133,14 +7154,14 @@ async function up$22(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN max_fanout_hosts INTEGER`.execute(db);
 }
-async function down$22(db) {
+async function down$29(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS max_fanout_hosts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/087_cluster_settings_event_router_rate_limit.ts
 var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add `cluster_settings.event_router_rate_limit_per_workflow_per_minute` (nullable INTEGER).
@@ -7150,7 +7171,7 @@ var _087_cluster_settings_event_router_rate_limit_exports = /* @__PURE__ */ __ex
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$21(db) {
+async function up$28(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7161,14 +7182,14 @@ async function up$21(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN event_router_rate_limit_per_workflow_per_minute INTEGER`.execute(db);
 }
-async function down$21(db) {
+async function down$28(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS event_router_rate_limit_per_workflow_per_minute`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/088_cluster_settings_cache_max_tarball_bytes.ts
 var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add `cluster_settings.cache_max_tarball_bytes` (nullable BIGINT).
@@ -7178,7 +7199,7 @@ var _088_cluster_settings_cache_max_tarball_bytes_exports = /* @__PURE__ */ __ex
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$20(db) {
+async function up$27(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7189,14 +7210,14 @@ async function up$20(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_max_tarball_bytes BIGINT`.execute(db);
 }
-async function down$20(db) {
+async function down$27(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_max_tarball_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/089_cluster_settings_cache_ttl_days.ts
 var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add `cluster_settings.cache_ttl_days` (nullable INTEGER).
@@ -7206,7 +7227,7 @@ var _089_cluster_settings_cache_ttl_days_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$19(db) {
+async function up$26(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7217,14 +7238,14 @@ async function up$19(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN cache_ttl_days INTEGER`.execute(db);
 }
-async function down$19(db) {
+async function down$26(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS cache_ttl_days`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/090_cluster_settings_concurrency_wait_timeout_ms.ts
 var _090_cluster_settings_concurrency_wait_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add `cluster_settings.concurrency_wait_timeout_ms` (nullable BIGINT).
@@ -7234,7 +7255,7 @@ var _090_cluster_settings_concurrency_wait_timeout_ms_exports = /* @__PURE__ */
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$18(db) {
+async function up$25(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7245,14 +7266,14 @@ async function up$18(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN concurrency_wait_timeout_ms BIGINT`.execute(db);
 }
-async function down$18(db) {
+async function down$25(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS concurrency_wait_timeout_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/091_cluster_settings_agent_token_ttl_ms.ts
 var _091_cluster_settings_agent_token_ttl_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Add `cluster_settings.agent_token_ttl_ms` (nullable BIGINT).
@@ -7262,7 +7283,7 @@ var _091_cluster_settings_agent_token_ttl_ms_exports = /* @__PURE__ */ __exportA
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$17(db) {
+async function up$24(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7273,14 +7294,14 @@ async function up$17(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN agent_token_ttl_ms BIGINT`.execute(db);
 }
-async function down$17(db) {
+async function down$24(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS agent_token_ttl_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/092_cluster_settings_version.ts
 var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add `cluster_settings.version` (monotonic BIGINT, bumped on each settings
@@ -7294,7 +7315,7 @@ var _092_cluster_settings_version_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$16(db) {
+async function up$23(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7305,14 +7326,14 @@ async function up$16(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN version BIGINT NOT NULL DEFAULT 0`.execute(db);
 }
-async function down$16(db) {
+async function down$23(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS version`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/093_org_settings_sandbox_allowlist.ts
 var _093_org_settings_sandbox_allowlist_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add the per-org container-sandbox escape-hatch allow-list to `org_settings`:
@@ -7330,7 +7351,7 @@ var _093_org_settings_sandbox_allowlist_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has a column skips that column.
 */
-async function columnExists$4(db, column) {
+async function columnExists$9(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7340,17 +7361,17 @@ async function columnExists$4(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$15(db) {
-	if (!await columnExists$4(db, "sandbox_allowed_capabilities")) await sql`
+async function up$22(db) {
+	if (!await columnExists$9(db, "sandbox_allowed_capabilities")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN sandbox_allowed_capabilities TEXT[]
     `.execute(db);
-	if (!await columnExists$4(db, "sandbox_allow_host_network")) await sql`
+	if (!await columnExists$9(db, "sandbox_allow_host_network")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN sandbox_allow_host_network BOOLEAN
     `.execute(db);
 }
-async function down$15(db) {
+async function down$22(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS sandbox_allowed_capabilities
   `.execute(db);
@@ -7361,8 +7382,8 @@ async function down$15(db) {
 //#endregion
 //#region src/db/migrations/094_dashboard_encryption_keys.ts
 var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add the `dashboard_encryption_keys` table: the cluster-scoped, long-lived
@@ -7381,12 +7402,12 @@ var _094_dashboard_encryption_keys_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: guarded on table existence.
 */
-async function up$14(db) {
+async function up$21(db) {
 	if (await tableExists(db, "dashboard_encryption_keys")) return;
 	await db.schema.createTable("dashboard_encryption_keys").addColumn("kid", "text", (c) => c.primaryKey()).addColumn("public_jwk", "jsonb", (c) => c.notNull()).addColumn("encrypted_private_key", "text", (c) => c.notNull()).addColumn("status", "text", (c) => c.notNull().defaultTo("active")).addColumn("revocation_reason", "text").addColumn("created_at", "timestamptz", (c) => c.notNull().defaultTo(sql`now()`)).addColumn("activated_at", "timestamptz").addColumn("revoked_at", "timestamptz").execute();
 	await db.schema.createIndex("idx_dashboard_encryption_keys_status").on("dashboard_encryption_keys").column("status").execute();
 }
-async function down$14(db) {
+async function down$21(db) {
 	await db.schema.dropTable("dashboard_encryption_keys").ifExists().execute();
 }
 async function tableExists(db, table) {
@@ -7400,8 +7421,8 @@ async function tableExists(db, table) {
 //#endregion
 //#region src/db/migrations/095_dashboard_write_policy_tristate.ts
 var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Migrate stored `org_settings.dashboard_write_policy` JSONB from the legacy
@@ -7419,7 +7440,7 @@ var _095_dashboard_write_policy_tristate_exports = /* @__PURE__ */ __exportAll({
 * Pure SQL rewrite: for each row, rebuild the object keeping only non-`true`
 * entries and mapping `false` → `'disabled'`, leaving existing string values.
 */
-async function up$13(db) {
+async function up$20(db) {
 	await sql`
     UPDATE org_settings
        SET dashboard_write_policy = COALESCE(
@@ -7446,12 +7467,12 @@ async function up$13(db) {
        )
   `.execute(db);
 }
-async function down$13() {}
+async function down$20() {}
 //#endregion
 //#region src/db/migrations/096_multi_schedule_cron_last_fired.ts
 var _096_multi_schedule_cron_last_fired_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Track cron last-fired per (registration, schedule) instead of per
@@ -7466,7 +7487,7 @@ var _096_multi_schedule_cron_last_fired_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on an already-migrated DB skips each step.
 */
-async function columnExists$3(db, column) {
+async function columnExists$8(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7486,8 +7507,8 @@ async function primaryKeyColumns(db) {
      ORDER BY a.attnum
   `.execute(db)).rows.map((row) => row.attname);
 }
-async function up$12(db) {
-	if (!await columnExists$3(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired ADD COLUMN schedule_key text`.execute(db);
+async function up$19(db) {
+	if (!await columnExists$8(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired ADD COLUMN schedule_key text`.execute(db);
 	await sql`
     UPDATE public.cron_last_fired clf
        SET schedule_key = k.key
@@ -7513,7 +7534,7 @@ async function up$12(db) {
     `.execute(db);
 	}
 }
-async function down$12(db) {
+async function down$19(db) {
 	await sql`
     DELETE FROM public.cron_last_fired a
       USING public.cron_last_fired b
@@ -7525,13 +7546,13 @@ async function down$12(db) {
     ALTER TABLE public.cron_last_fired
       ADD CONSTRAINT cron_last_fired_pkey PRIMARY KEY (registration_id)
   `.execute(db);
-	if (await columnExists$3(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired DROP COLUMN schedule_key`.execute(db);
+	if (await columnExists$8(db, "schedule_key")) await sql`ALTER TABLE public.cron_last_fired DROP COLUMN schedule_key`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/097_execution_runs_pr_number.ts
 var _097_execution_runs_pr_number_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add `pr_number INTEGER NULL` to `execution_runs`.
@@ -7544,7 +7565,7 @@ var _097_execution_runs_pr_number_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function columnExists$2(db, column) {
+async function columnExists$7(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7554,13 +7575,13 @@ async function columnExists$2(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$11(db) {
-	if (!await columnExists$2(db, "pr_number")) await sql`
+async function up$18(db) {
+	if (!await columnExists$7(db, "pr_number")) await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN pr_number INTEGER
     `.execute(db);
 }
-async function down$11(db) {
+async function down$18(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS pr_number
   `.execute(db);
@@ -7568,8 +7589,8 @@ async function down$11(db) {
 //#endregion
 //#region src/db/migrations/098_execution_runs_customer_id.ts
 var _098_execution_runs_customer_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Denormalize the owning org onto `execution_runs` so the concurrency-gate
@@ -7587,7 +7608,7 @@ var _098_execution_runs_customer_id_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running skips the column when it already exists.
 */
-async function columnExists$1(db, column) {
+async function columnExists$6(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7597,8 +7618,8 @@ async function columnExists$1(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$10(db) {
-	if (!await columnExists$1(db, "customer_id")) {
+async function up$17(db) {
+	if (!await columnExists$6(db, "customer_id")) {
 		await sql`
       ALTER TABLE public.execution_runs
         ADD COLUMN customer_id TEXT NOT NULL DEFAULT '__default__'
@@ -7621,7 +7642,7 @@ async function up$10(db) {
       ON public.execution_runs (customer_id, context)
   `.execute(db);
 }
-async function down$10(db) {
+async function down$17(db) {
 	await sql`DROP INDEX IF EXISTS execution_runs_customer_id_context_idx`.execute(db);
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS customer_id
@@ -7630,8 +7651,8 @@ async function down$10(db) {
 //#endregion
 //#region src/db/migrations/099_cluster_settings_dashboard_verified_issuer.ts
 var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add `cluster_settings.dashboard_verified_issuer` (nullable text).
@@ -7650,7 +7671,7 @@ var _099_cluster_settings_dashboard_verified_issuer_exports = /* @__PURE__ */ __
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$9(db) {
+async function up$16(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7661,14 +7682,14 @@ async function up$9(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN dashboard_verified_issuer TEXT`.execute(db);
 }
-async function down$9(db) {
+async function down$16(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS dashboard_verified_issuer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/100_held_runs_hold_type_vocabulary.ts
 var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Realign `held_runs.hold_type` onto the engine's `HoldType` vocabulary.
@@ -7687,7 +7708,7 @@ var _100_held_runs_hold_type_vocabulary_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a second run matches no rows.
 */
-async function up$8(db) {
+async function up$15(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'reviewer' WHERE hold_type = 'approval'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'timer' WHERE hold_type = 'wait_timer'`.execute(db);
 }
@@ -7701,15 +7722,15 @@ async function up$8(db) {
 * `wait_timer` alone, so leaving those rows spelled `timer` would strand them
 * in the expire-and-fail path.
 */
-async function down$8(db) {
+async function down$15(db) {
 	await sql`UPDATE public.held_runs SET hold_type = 'approval' WHERE hold_type = 'reviewer'`.execute(db);
 	await sql`UPDATE public.held_runs SET hold_type = 'wait_timer' WHERE hold_type = 'timer'`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/101_contexts_hold_expiry_drop_default.ts
 var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Give the context hold expiry a single default, and retire the stored zeroes.
@@ -7730,7 +7751,7 @@ var _101_contexts_hold_expiry_drop_default_exports = /* @__PURE__ */ __exportAll
 * Idempotent: dropping an absent default is a no-op and the UPDATE matches no
 * rows on a second run.
 */
-async function up$7(db) {
+async function up$14(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds DROP DEFAULT`.execute(db);
 	await sql`UPDATE public.contexts SET hold_expiry_seconds = NULL WHERE hold_expiry_seconds = 0`.execute(db);
 }
@@ -7742,14 +7763,14 @@ async function up$7(db) {
 * back to `0` would resume cancelling every hold on its context — so a
 * rollback keeps them on the fallback rather than re-breaking them.
 */
-async function down$7(db) {
+async function down$14(db) {
 	await sql`ALTER TABLE public.contexts ALTER COLUMN hold_expiry_seconds SET DEFAULT 86400`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/102_dispatch_queue_agent_id.ts
 var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Add `dispatch_queue.agent_id` (nullable text).
@@ -7767,7 +7788,7 @@ var _102_dispatch_queue_agent_id_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$6(db) {
+async function up$13(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7778,14 +7799,14 @@ async function up$6(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.dispatch_queue ADD COLUMN agent_id TEXT`.execute(db);
 }
-async function down$6(db) {
+async function down$13(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS agent_id`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/103_cluster_settings_ownership_db_check_timeout_ms.ts
 var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Add `cluster_settings.ownership_db_check_timeout_ms` (nullable bigint).
@@ -7803,7 +7824,7 @@ var _103_cluster_settings_ownership_db_check_timeout_ms_exports = /* @__PURE__ *
 * Idempotent: guarded on column existence; a re-run on a DB that already has the
 * column is a no-op.
 */
-async function up$5(db) {
+async function up$12(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -7814,14 +7835,14 @@ async function up$5(db) {
   `.execute(db)).rows[0]?.exists) return;
 	await sql`ALTER TABLE public.cluster_settings ADD COLUMN ownership_db_check_timeout_ms BIGINT`.execute(db);
 }
-async function down$5(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ownership_db_check_timeout_ms`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/104_check_run_terminal_sent.ts
 var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add `check_run_tracking.terminal_sent_at` (nullable timestamptz).
@@ -7841,149 +7862,467 @@ var _104_check_run_terminal_sent_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: guarded on column existence; a re-run on a DB that already has
 * the column is a no-op.
 */
-async function up$4(db) {
-	if ((await sql`
+async function up$11(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'check_run_tracking'
+         AND column_name = 'terminal_sent_at'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`ALTER TABLE public.check_run_tracking ADD COLUMN terminal_sent_at TIMESTAMPTZ`.execute(db);
+}
+async function down$11(db) {
+	await sql`ALTER TABLE public.check_run_tracking DROP COLUMN IF EXISTS terminal_sent_at`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/105_org_trust_policy.ts
+var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$10,
+	up: () => up$10
+});
+/**
+* Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
+* trust policy pushed on `trust_policy.update`.
+*
+* A dedicated table rather than `org_settings` columns, because this is
+* Platform-owned policy the orchestrator consumes, not operator-owned config the
+* operator tunes. `source` records which of the two wrote the row so the admin
+* surface can present a Platform-managed policy as read-only.
+*
+* Persisting rather than caching in memory is deliberate: a security policy that
+* silently reverts to a default across a restart is worse than one that is never
+* applied.
+*
+* Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
+*/
+async function up$10(db) {
+	await sql`
+    CREATE TABLE IF NOT EXISTS public.org_trust_policy (
+      customer_id                TEXT PRIMARY KEY,
+      fork_policy                TEXT        NOT NULL,
+      unknown_contributor_policy TEXT        NOT NULL,
+      workflow_change_policy     TEXT        NOT NULL,
+      approval_expiry_hours      INTEGER     NOT NULL,
+      source                     TEXT        NOT NULL,
+      updated_at                 TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `.execute(db);
+}
+async function down$10(db) {
+	await sql`DROP TABLE IF EXISTS public.org_trust_policy`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.ts
+var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$9,
+	up: () => up$9
+});
+/**
+* Add `cluster_settings.check_run_tracking_ttl_days` (nullable integer).
+*
+* Retention window for `check_run_tracking` rows. The hourly cleanup sweep
+* deletes rows untouched for longer than this; 0 disables the sweep.
+*
+* Cluster-global (the sweep runs once per fleet on the cleanup tick, with no
+* tenant in scope at the read site), so it lives on `cluster_settings` rather
+* than `org_settings`. NULL means the orchestrator's own configured default
+* applies.
+*
+* Idempotent: guarded on column existence; a re-run on a database that already
+* has the column is a no-op.
+*/
+async function up$9(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = 'cluster_settings'
+         AND column_name = 'check_run_tracking_ttl_days'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`ALTER TABLE public.cluster_settings ADD COLUMN check_run_tracking_ttl_days INTEGER`.execute(db);
+}
+async function down$9(db) {
+	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS check_run_tracking_ttl_days`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/107_check_run_tracking_updated_at_index.ts
+var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$8,
+	up: () => up$8
+});
+/**
+* Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
+*
+* `CheckRunTrackingStore.pruneStale` — the hourly retention sweep — filters
+* `WHERE updated_at < now() - <window>`. The table already carries two indexes
+* — the primary key on `(provider, owner, repo, sha, check_name)` and the
+* partial `idx_check_run_tracking_run_id` — but `updated_at` leads neither, so
+* that predicate can use neither and without this index every sweep
+* sequentially scans the whole table. The scan
+* is worst exactly where it hurts: a deployment that accumulated rows before
+* retention existed has the largest table and gets the scan hourly, on every
+* coordinator, since the cleanup tick is not leader-gated.
+*
+* Mirrors `idx_dispatch_queue_run_id` (migration 072) and
+* `idx_request_idempotency_created_at` (migration 068), both of which exist to
+* index a TTL sweep's prune predicate.
+*
+* Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+*/
+async function up$8(db) {
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_check_run_tracking_updated_at
+      ON public.check_run_tracking (updated_at)
+  `.execute(db);
+}
+async function down$8(db) {
+	await sql`DROP INDEX IF EXISTS public.idx_check_run_tracking_updated_at`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/108_unroutable_fast_fail.ts
+var _108_unroutable_fast_fail_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$7,
+	up: () => up$7
+});
+/**
+* Fast-fail support for jobs nothing in the fleet can run.
+*
+* Three additive, nullable columns:
+*
+* - `cluster_settings.unroutable_grace_ms` — how long a job may stay
+*   continuously unroutable before it is terminalized. NULL means the
+*   orchestrator's configured default applies; 0 disables fast-fail and leaves
+*   the `queue_timeout_ms` backstop as the only path.
+* - `dispatch_queue.unroutable_since` — when the job first read unroutable.
+*   Persisted rather than in-memory so a restart mid-grace resumes the same
+*   clock instead of resetting it; an orchestrator that bounces every 90s must
+*   not be able to keep a genuinely dead job alive forever. Cleared the moment
+*   the job reads routable again.
+* - `execution_jobs.routing_reason` — the operator-facing reason, visible while
+*   the job is still queued. Cleared on recovery.
+*
+* Idempotent: each column is guarded on existence, so a re-run is a no-op.
+*/
+async function columnExists$5(db, table, column) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${column}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists === true;
+}
+async function up$7(db) {
+	if (!await columnExists$5(db, "cluster_settings", "unroutable_grace_ms")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN unroutable_grace_ms INTEGER`.execute(db);
+	if (!await columnExists$5(db, "dispatch_queue", "unroutable_since")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN unroutable_since TIMESTAMPTZ`.execute(db);
+	if (!await columnExists$5(db, "execution_jobs", "routing_reason")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN routing_reason TEXT`.execute(db);
+}
+async function down$7(db) {
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS routing_reason`.execute(db);
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS unroutable_since`.execute(db);
+	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS unroutable_grace_ms`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/109_cluster_settings_cache_knobs.ts
+var _109_cluster_settings_cache_knobs_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
+/**
+* Cluster-global cache tunables for the lock-file cache and the Tier-1
+* content-requirements cache.
+*
+* Six additive, nullable columns. NULL means the orchestrator's configured
+* default applies (the `KICI_LOCKFILE_CACHE_*` / `KICI_CONTENT_CACHE_*` env
+* vars stay as the cluster-wide defaults). Sizes and TTLs are structural to the
+* underlying LRU, so a change takes effect at the next orchestrator restart.
+*
+* BIGINT rather than INTEGER: a byte ceiling defaults to 64 MiB and the TTLs are
+* in milliseconds, so both leave INTEGER range as soon as an operator raises
+* them.
+*
+* Idempotent: each column is guarded on existence, so a re-run is a no-op.
+*/
+async function columnExists$4(db, table, column) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${column}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists === true;
+}
+const COLUMNS$2 = [
+	"lockfile_cache_max",
+	"lockfile_cache_max_bytes",
+	"lockfile_cache_ttl_ms",
+	"content_cache_max",
+	"content_cache_max_bytes",
+	"content_cache_ttl_ms"
+];
+async function up$6(db) {
+	for (const column of COLUMNS$2) if (!await columnExists$4(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
+}
+async function down$6(db) {
+	for (const column of COLUMNS$2) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/110_cluster_settings_global_eval_knobs.ts
+var _110_cluster_settings_global_eval_knobs_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* Cluster-global tunables for the Tier-2 global eval round — the pre-run job
+* that evaluates each candidate global workflow's `filter` and generators on one
+* shared checkout of the source and workflow repos.
+*
+* Three additive, nullable columns. NULL means the orchestrator's configured
+* default applies (the `KICI_GLOBAL_EVAL_*` env vars stay as the cluster-wide
+* defaults). The two budgets are read per round and shipped to the agent in the
+* round's job config, so a change lands on the next push; `global_eval_cache_max`
+* sizes an LRU built once at boot and therefore applies at the next restart.
+*
+* BIGINT rather than INTEGER: the budgets are in milliseconds, so an operator
+* raising one leaves INTEGER range with a single generous value.
+*
+* Idempotent: each column is guarded on existence, so a re-run is a no-op.
+*/
+async function columnExists$3(db, table, column) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${column}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists === true;
+}
+const COLUMNS$1 = [
+	"global_eval_round_timeout_ms",
+	"global_eval_candidate_timeout_ms",
+	"global_eval_cache_max"
+];
+async function up$5(db) {
+	for (const column of COLUMNS$1) if (!await columnExists$3(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
+}
+async function down$5(db) {
+	for (const column of COLUMNS$1) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/111_cluster_settings_global_eval_wait.ts
+var _111_cluster_settings_global_eval_wait_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* Cluster-global ceiling on how long webhook processing waits for a Tier-2
+* global eval round to settle.
+*
+* One additive, nullable column. NULL means the orchestrator's configured
+* default applies (`KICI_GLOBAL_EVAL_WAIT_TIMEOUT_MS` stays the cluster-wide
+* default). It is read fresh per round and applies orchestrator-side — unlike
+* the two agent budgets, which are shipped inside the round's job config — so a
+* change lands on the next push.
+*
+* BIGINT rather than INTEGER: the value is in milliseconds, so an operator
+* raising it leaves INTEGER range with a single generous value.
+*
+* Idempotent: the column is guarded on existence, so a re-run is a no-op.
+*/
+async function columnExists$2(db, table, column) {
+	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
        WHERE table_schema = 'public'
-         AND table_name = 'check_run_tracking'
-         AND column_name = 'terminal_sent_at'
+         AND table_name = ${table}
+         AND column_name = ${column}
     ) AS exists
-  `.execute(db)).rows[0]?.exists) return;
-	await sql`ALTER TABLE public.check_run_tracking ADD COLUMN terminal_sent_at TIMESTAMPTZ`.execute(db);
+  `.execute(db)).rows[0]?.exists === true;
+}
+const COLUMNS = ["global_eval_wait_timeout_ms"];
+async function up$4(db) {
+	for (const column of COLUMNS) if (!await columnExists$2(db, "cluster_settings", column)) await sql`ALTER TABLE public.cluster_settings ADD COLUMN ${sql.ref(column)} BIGINT`.execute(db);
 }
 async function down$4(db) {
-	await sql`ALTER TABLE public.check_run_tracking DROP COLUMN IF EXISTS terminal_sent_at`.execute(db);
+	for (const column of COLUMNS) await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ${sql.ref(column)}`.execute(db);
 }
 //#endregion
-//#region src/db/migrations/105_org_trust_policy.ts
-var _105_org_trust_policy_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/112_execution_runs_workflow_repo.ts
+var _112_execution_runs_workflow_repo_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$3,
 	up: () => up$3
 });
 /**
-* Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
-* trust policy pushed on `trust_policy.update`.
+* Record which repository DEFINED the workflow a run executed.
 *
-* A dedicated table rather than `org_settings` columns, because this is
-* Platform-owned policy the orchestrator consumes, not operator-owned config the
-* operator tunes. `source` records which of the two wrote the row so the admin
-* surface can present a Platform-managed policy as read-only.
+* `execution_runs.repo_identifier` is the repository the run acted on. For an
+* organization-wide workflow dispatched against another repository those are
+* two different repositories: `repo_identifier` holds the source repository
+* that emitted the event, while the workflow itself was authored elsewhere and
+* travels only per job in `jobConfig.workflowRepoIdentifier` — which lives in
+* `dispatch_queue.job_config` and is pruned once the run's queue rows age out.
 *
-* Persisting rather than caching in memory is deliberate: a security policy that
-* silently reverts to a default across a restart is worse than one that is never
-* applied.
+* So the run row alone could not answer "which repository defines this
+* workflow", and the rerun path read `repo_identifier` as the answer: it
+* re-fetched the source repository's lock file and either failed with a
+* misleading force-push message or, on a same-named workflow, silently ran the
+* source repository's workflow instead.
 *
-* Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
+* Nullable and unbackfilled by design: a null means "the run acted on the
+* repository that defines its workflow", which is true of every per-repository
+* run and of every row written before this column existed.
+*
+* Idempotent: guarded on the column's existence, so re-running is a no-op.
 */
+async function colExists(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
 async function up$3(db) {
-	await sql`
-    CREATE TABLE IF NOT EXISTS public.org_trust_policy (
-      customer_id                TEXT PRIMARY KEY,
-      fork_policy                TEXT        NOT NULL,
-      unknown_contributor_policy TEXT        NOT NULL,
-      workflow_change_policy     TEXT        NOT NULL,
-      approval_expiry_hours      INTEGER     NOT NULL,
-      source                     TEXT        NOT NULL,
-      updated_at                 TIMESTAMPTZ NOT NULL DEFAULT now()
-    )
-  `.execute(db);
+	if (!await colExists(db, "execution_runs", "workflow_repo_identifier")) await sql`
+      ALTER TABLE public.execution_runs
+        ADD COLUMN workflow_repo_identifier text
+    `.execute(db);
 }
 async function down$3(db) {
-	await sql`DROP TABLE IF EXISTS public.org_trust_policy`.execute(db);
+	await sql`
+    ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_repo_identifier
+  `.execute(db);
 }
 //#endregion
-//#region src/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.ts
-var _106_cluster_settings_check_run_tracking_ttl_days_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/113_execution_runs_workflow_repo_index.ts
+var _113_execution_runs_workflow_repo_index_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$2,
 	up: () => up$2
 });
 /**
-* Add `cluster_settings.check_run_tracking_ttl_days` (nullable integer).
-*
-* Retention window for `check_run_tracking` rows. The hourly cleanup sweep
-* deletes rows untouched for longer than this; 0 disables the sweep.
-*
-* Cluster-global (the sweep runs once per fleet on the cleanup tick, with no
-* tenant in scope at the read site), so it lives on `cluster_settings` rather
-* than `org_settings`. NULL means the orchestrator's own configured default
-* applies.
+* Add the partial index `idx_execution_runs_workflow_repo` on
+* `execution_runs (workflow_repo_identifier) WHERE workflow_repo_identifier IS NOT NULL`.
+*
+* Matching a workflow registration to its runs keys on the repository that
+* DEFINES the workflow — `workflow_repo_identifier ?? repo_identifier` — which
+* the orchestrator expresses as
+* `workflow_repo_identifier IN (…) OR (workflow_repo_identifier IS NULL AND repo_identifier IN (…))`
+* (`registration/registration-run-match.ts`). The second arm rides
+* `idx_execution_runs_repo` from migration 001; the first arm had no index at
+* all, because migration 112 added the column without one. A planner cannot
+* use an index for only half a disjunction, so the whole predicate degraded to
+* a sequential scan over a table that grows with every run — on
+* `dashboard.registrations.list`, which runs its grouped MAX on every list
+* request.
+*
+* With both arms indexed the planner can BitmapOr them.
+*
+* Partial by design, and the partiality is what makes it cheap: the column is
+* non-null only for a cross-repository organization-wide run, a small minority
+* of rows, so the index stays a fraction of the table's size and skips every
+* per-repository run. It also matches the predicate exactly — the first arm
+* can never match a NULL row, since `NULL IN (…)` is never true.
 *
-* Idempotent: guarded on column existence; a re-run on a database that already
-* has the column is a no-op.
+* Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
 */
 async function up$2(db) {
-	if ((await sql`
-    SELECT EXISTS (
-      SELECT 1 FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = 'cluster_settings'
-         AND column_name = 'check_run_tracking_ttl_days'
-    ) AS exists
-  `.execute(db)).rows[0]?.exists) return;
-	await sql`ALTER TABLE public.cluster_settings ADD COLUMN check_run_tracking_ttl_days INTEGER`.execute(db);
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_execution_runs_workflow_repo
+      ON public.execution_runs (workflow_repo_identifier)
+      WHERE workflow_repo_identifier IS NOT NULL
+  `.execute(db);
 }
 async function down$2(db) {
-	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS check_run_tracking_ttl_days`.execute(db);
+	await sql`DROP INDEX IF EXISTS public.idx_execution_runs_workflow_repo`.execute(db);
 }
 //#endregion
-//#region src/db/migrations/107_check_run_tracking_updated_at_index.ts
-var _107_check_run_tracking_updated_at_index_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/114_ingest_queue_claim.ts
+var _114_ingest_queue_claim_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$1,
 	up: () => up$1
 });
 /**
-* Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
+* Claim bookkeeping for the durable ingest queue.
 *
-* `CheckRunTrackingStore.pruneStale` — the hourly retention sweep — filters
-* `WHERE updated_at < now() - <window>`. The table already carries two indexes
-* — the primary key on `(provider, owner, repo, sha, check_name)` and the
-* partial `idx_check_run_tracking_run_id` — but `updated_at` leads neither, so
-* that predicate can use neither and without this index every sweep
-* sequentially scans the whole table. The scan
-* is worst exactly where it hurts: a deployment that accumulated rows before
-* retention existed has the largest table and gets the scan hourly, on every
-* coordinator, since the cleanup tick is not leader-gated.
+* Two additive, nullable columns:
 *
-* Mirrors `idx_dispatch_queue_run_id` (migration 072) and
-* `idx_request_idempotency_created_at` (migration 068), both of which exist to
-* index a TTL sweep's prune predicate.
+* - `ingest_overflow_buffer.claimed_at` — when a row moved `buffered` →
+*   `replaying`. A worker that dies mid-pipeline leaves its row in `replaying`
+*   with nothing to move it back, so the drain pass reclaims a row whose claim
+*   is older than the timeout below. The claim clock has to be its own column:
+*   `captured_at` orders the FIFO drain, so an old row picked up first would
+*   read as instantly stale and be reclaimed out from under a live worker.
+* - `cluster_settings.ingest_overflow_claim_timeout_ms` — how long a claim may
+*   stand before the drain pass reclaims it. NULL means the orchestrator's
+*   configured default applies. It must exceed the longest a single delivery's
+*   pipeline can legitimately run (a build phase alone is capped at
+*   `cacheBuildTimeoutMs`), or a reclaim would re-run work still in flight.
 *
-* Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+* Idempotent: each column is guarded on existence, so a re-run is a no-op.
 */
+async function columnExists$1(db, table, column) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${column}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists === true;
+}
 async function up$1(db) {
-	await sql`
-    CREATE INDEX IF NOT EXISTS idx_check_run_tracking_updated_at
-      ON public.check_run_tracking (updated_at)
-  `.execute(db);
+	if (!await columnExists$1(db, "ingest_overflow_buffer", "claimed_at")) await sql`ALTER TABLE public.ingest_overflow_buffer ADD COLUMN claimed_at TIMESTAMPTZ`.execute(db);
+	if (!await columnExists$1(db, "cluster_settings", "ingest_overflow_claim_timeout_ms")) await sql`
+      ALTER TABLE public.cluster_settings ADD COLUMN ingest_overflow_claim_timeout_ms INTEGER
+    `.execute(db);
 }
 async function down$1(db) {
-	await sql`DROP INDEX IF EXISTS public.idx_check_run_tracking_updated_at`.execute(db);
+	await sql`
+    ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS ingest_overflow_claim_timeout_ms
+  `.execute(db);
+	await sql`
+    ALTER TABLE public.ingest_overflow_buffer DROP COLUMN IF EXISTS claimed_at
+  `.execute(db);
 }
 //#endregion
-//#region src/db/migrations/108_unroutable_fast_fail.ts
-var _108_unroutable_fast_fail_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/115_global_workflows_cluster_switch.ts
+var _115_global_workflows_cluster_switch_exports = /* @__PURE__ */ __exportAll({
 	down: () => down,
 	up: () => up
 });
 /**
-* Fast-fail support for jobs nothing in the fleet can run.
+* Move the global-workflows master switch from `org_settings` to
+* `cluster_settings`.
 *
-* Three additive, nullable columns:
+* The switch decides whether any repo may register or dispatch a global
+* workflow — a workflow defined in one repo that runs against events emitted by
+* other repos in the org, optionally with elevated access to source-repo
+* secrets. That is an operator-held decision, so it belongs on the fleet-wide
+* row an operator reaches through `kici-admin cluster-settings`, not on a
+* per-org row an org admin can flip from the dashboard.
 *
-* - `cluster_settings.unroutable_grace_ms` — how long a job may stay
-*   continuously unroutable before it is terminalized. NULL means the
-*   orchestrator's configured default applies; 0 disables fast-fail and leaves
-*   the `queue_timeout_ms` backstop as the only path.
-* - `dispatch_queue.unroutable_since` — when the job first read unroutable.
-*   Persisted rather than in-memory so a restart mid-grace resumes the same
-*   clock instead of resetting it; an orchestrator that bounces every 90s must
-*   not be able to keep a genuinely dead job alive forever. Cleared the moment
-*   the job reads routable again.
-* - `execution_jobs.routing_reason` — the operator-facing reason, visible while
-*   the job is still queued. Cleared on recovery.
+* Deliberately NOT back-filled. Copying `EXISTS(SELECT 1 FROM org_settings
+* WHERE global_workflows_enabled)` into the new column would silently carry a
+* per-org opt-in forward into a fleet-wide one — enabling globals for orgs
+* whose operator never chose it. The new column starts NULL, which resolves to
+* the orchestrator's configured default (`KICI_GLOBAL_WORKFLOWS_ENABLED`,
+* default false), so global workflows are off until an operator opts in:
 *
-* Idempotent: each column is guarded on existence, so a re-run is a no-op.
+*   kici-admin cluster-settings set --global-workflows-enabled true
+*
+* BOOLEAN and nullable, matching the `NULL ⇒ configured default` contract every
+* other `cluster_settings` knob follows.
+*
+* Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
+* re-run is a no-op.
 */
 async function columnExists(db, table, column) {
 	return (await sql`
@@ -7996,14 +8335,20 @@ async function columnExists(db, table, column) {
   `.execute(db)).rows[0]?.exists === true;
 }
 async function up(db) {
-	if (!await columnExists(db, "cluster_settings", "unroutable_grace_ms")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN unroutable_grace_ms INTEGER`.execute(db);
-	if (!await columnExists(db, "dispatch_queue", "unroutable_since")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN unroutable_since TIMESTAMPTZ`.execute(db);
-	if (!await columnExists(db, "execution_jobs", "routing_reason")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN routing_reason TEXT`.execute(db);
+	if (!await columnExists(db, "cluster_settings", "global_workflows_enabled")) await sql`ALTER TABLE public.cluster_settings ADD COLUMN global_workflows_enabled BOOLEAN`.execute(db);
+	await sql`ALTER TABLE public.org_settings DROP COLUMN IF EXISTS global_workflows_enabled`.execute(db);
 }
+/**
+* Restores the org column with its original NOT NULL DEFAULT false. A rollback
+* cannot recover the per-org values the up-migration dropped — they are gone —
+* so every org comes back at the opt-in default.
+*/
 async function down(db) {
-	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS routing_reason`.execute(db);
-	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS unroutable_since`.execute(db);
-	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS unroutable_grace_ms`.execute(db);
+	if (!await columnExists(db, "org_settings", "global_workflows_enabled")) await sql`
+      ALTER TABLE public.org_settings
+        ADD COLUMN global_workflows_enabled BOOLEAN NOT NULL DEFAULT false
+    `.execute(db);
+	await sql`ALTER TABLE public.cluster_settings DROP COLUMN IF EXISTS global_workflows_enabled`.execute(db);
 }
 //#endregion
 //#region src/db/migration-provider.ts
@@ -8117,7 +8462,14 @@ function createMigrationProvider() {
 			"105_org_trust_policy": _105_org_trust_policy_exports,
 			"106_cluster_settings_check_run_tracking_ttl_days": _106_cluster_settings_check_run_tracking_ttl_days_exports,
 			"107_check_run_tracking_updated_at_index": _107_check_run_tracking_updated_at_index_exports,
-			"108_unroutable_fast_fail": _108_unroutable_fast_fail_exports
+			"108_unroutable_fast_fail": _108_unroutable_fast_fail_exports,
+			"109_cluster_settings_cache_knobs": _109_cluster_settings_cache_knobs_exports,
+			"110_cluster_settings_global_eval_knobs": _110_cluster_settings_global_eval_knobs_exports,
+			"111_cluster_settings_global_eval_wait": _111_cluster_settings_global_eval_wait_exports,
+			"112_execution_runs_workflow_repo": _112_execution_runs_workflow_repo_exports,
+			"113_execution_runs_workflow_repo_index": _113_execution_runs_workflow_repo_index_exports,
+			"114_ingest_queue_claim": _114_ingest_queue_claim_exports,
+			"115_global_workflows_cluster_switch": _115_global_workflows_cluster_switch_exports
 		};
 	} };
 }
@@ -9034,7 +9386,13 @@ const UniversalGitPayloadPathsSchema = z.object({
 	/** Path to the `modified` files array on a push event. */
 	commitsModified: z.string().min(1),
 	/** Path to the `removed` files array on a push event. */
-	commitsRemoved: z.string().min(1)
+	commitsRemoved: z.string().min(1),
+	/**
+	* Path to the head commit's message on a push event. Optional so a stored
+	* config written before this field stays valid; when unset, a `commitMessage`
+	* trigger filter is INDETERMINATE and the workflow does not run.
+	*/
+	commitMessage: z.string().min(1).optional()
 });
 /**
 * Header-to-event-name mapping. Most forges send an `X-Event-Type`-style
@@ -9133,7 +9491,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			defaultBranch: "$.repository.default_branch",
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
-			commitsRemoved: "$.commits[*].removed[*]"
+			commitsRemoved: "$.commits[*].removed[*]",
+			commitMessage: "$.head_commit.message"
 		},
 		eventMapping: {
 			push: ["push"],
@@ -9149,7 +9508,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			defaultBranch: "$.repository.default_branch",
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
-			commitsRemoved: "$.commits[*].removed[*]"
+			commitsRemoved: "$.commits[*].removed[*]",
+			commitMessage: "$.head_commit.message"
 		},
 		eventMapping: {
 			push: ["push"],
@@ -9165,7 +9525,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			defaultBranch: "$.repository.default_branch",
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
-			commitsRemoved: "$.commits[*].removed[*]"
+			commitsRemoved: "$.commits[*].removed[*]",
+			commitMessage: "$.commits[-1:].message"
 		},
 		eventMapping: {
 			push: ["push"],
@@ -9181,7 +9542,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			defaultBranch: "$.project.default_branch",
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
-			commitsRemoved: "$.commits[*].removed[*]"
+			commitsRemoved: "$.commits[*].removed[*]",
+			commitMessage: "$.commits[-1:].message"
 		},
 		eventMapping: {
 			push: ["Push Hook", "push"],
@@ -9197,7 +9559,8 @@ const UNIVERSAL_GIT_PRESETS = {
 			defaultBranch: "$.repository.default_branch",
 			commitsAdded: "$.commits[*].added[*]",
 			commitsModified: "$.commits[*].modified[*]",
-			commitsRemoved: "$.commits[*].removed[*]"
+			commitsRemoved: "$.commits[*].removed[*]",
+			commitMessage: "$.head_commit.message"
 		},
 		eventMapping: {
 			push: ["push"],
@@ -10131,6 +10494,21 @@ function parseLocalConfig(s) {
 	const parsed = LocalSourceConfigSchema.safeParse(raw);
 	return parsed.success ? parsed.data : null;
 }
+/**
+* Read a local source's stored config over whichever transport the caller is
+* already on — direct DB when `--database-url` / KICI_DATABASE_URL is in play,
+* otherwise the admin API. Used to preserve `repoBasePath` when only the clone
+* base is being changed; returns null when the id names no local source.
+*/
+async function readLocalSourceConfig(id, databaseUrl, getClient) {
+	const dbUrl = resolveDirectDbUrl$9(databaseUrl);
+	if (dbUrl) {
+		const row = await withGenericManager(dbUrl, (mgr) => mgr.getById(id));
+		return row ? parseLocalConfig(row) : null;
+	}
+	const { source } = await getClient().getGenericSource(id);
+	return parseLocalConfig(source);
+}
 function safeParse(value) {
 	try {
 		return JSON.parse(value);
@@ -10676,17 +11054,26 @@ function registerSourceCommands(program, getClient) {
 		try {
 			const data = {};
 			if (opts.name) data.name = opts.name;
-			if (opts.path !== void 0) {
-				if (!path.isAbsolute(opts.path)) {
-					console.error(`Error: --path must be an absolute path: ${opts.path}`);
+			if (opts.path !== void 0 || opts.cloneUrlBase !== void 0) {
+				let repoBasePath = opts.path;
+				if (repoBasePath === void 0) {
+					const existing = await readLocalSourceConfig(id, opts.databaseUrl, getClient);
+					if (!existing) {
+						console.error(`Error: no local source with id ${id}`);
+						process.exit(1);
+					}
+					repoBasePath = existing.repoBasePath;
+				}
+				if (!path.isAbsolute(repoBasePath)) {
+					console.error(`Error: --path must be an absolute path: ${repoBasePath}`);
 					process.exit(1);
 				}
-				const localConfig = { repoBasePath: opts.path };
+				const localConfig = { repoBasePath };
 				if (opts.cloneUrlBase) localConfig.cloneUrlBase = opts.cloneUrlBase;
 				data.localConfig = localConfig;
 			}
 			if (Object.keys(data).length === 0) {
-				console.error("Error: no fields to update. Provide --path and/or --name.");
+				console.error("Error: no fields to update. Provide --path, --name, and/or --clone-url-base.");
 				process.exit(1);
 			}
 			const dbUrl = resolveDirectDbUrl$9(opts.databaseUrl);
@@ -11320,6 +11707,23 @@ function registerRunsCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	runs.command("logs <runId>").description("Print a page of a step log (dogfooded via /api/v1/admin/runs/:runId/jobs/:jobId/steps/:i/logs)").requiredOption("--job <jobId>", "Job id (the dispatch_queue row id for an eval round)").option("--step <n>", "Step index (default 0)", "0").option("--limit <n>", "Max lines to return (default 500, server caps at 2000)", "500").option("--cursor <c>", "Line-offset cursor from a previous page").option("--json", "Emit raw JSON instead of plain lines").action(async (runId, opts) => {
+		try {
+			const params = new URLSearchParams({ limit: String(opts.limit) });
+			if (opts.cursor) params.set("cursor", String(opts.cursor));
+			const path = `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs/${encodeURIComponent(String(opts.job))}/steps/${encodeURIComponent(String(opts.step))}/logs?${params.toString()}`;
+			const response = await getClient().get(path);
+			if (opts.json) {
+				console.log(JSON.stringify(response, null, 2));
+				return;
+			}
+			for (const line of response.lines) console.log(line.value);
+			if (response.nextCursor) console.error(`(more: re-run with --cursor ${response.nextCursor})`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 	runs.command("ephemeral-key <runId>").description("Show whether the run-ephemeral key has been scrubbed yet").option("--json", "Emit raw JSON instead of plain text").action(async (runId, opts) => {
 		try {
 			const response = await getClient().getRunEphemeralKey(runId);
@@ -11489,6 +11893,13 @@ const baseSchema = z.object({
 	lockfileCacheMax: z.coerce.number().default(500),
 	lockfileCacheTtlMs: z.coerce.number().default(36e5),
 	lockfileCacheMaxBytes: z.coerce.number().default(64 * 1024 * 1024),
+	contentCacheMax: z.coerce.number().default(500),
+	contentCacheTtlMs: z.coerce.number().default(36e5),
+	contentCacheMaxBytes: z.coerce.number().default(64 * 1024 * 1024),
+	globalEvalRoundTimeoutMs: z.coerce.number().default(12e4),
+	globalEvalCandidateTimeoutMs: z.coerce.number().default(2e4),
+	globalEvalCacheMax: z.coerce.number().default(500),
+	globalEvalWaitTimeoutMs: z.coerce.number().default(24e4),
 	queueMaxDepth: z.coerce.number().default(1e3),
 	queueTimeoutMs: z.coerce.number().default(36e5),
 	/**
@@ -11498,6 +11909,15 @@ const baseSchema = z.object({
 	*/
 	unroutableGraceMs: z.coerce.number().default(12e4),
 	/**
+	* Fleet-wide default for the global-workflows master switch. Cluster default;
+	* the live value is the `global_workflows_enabled` cluster setting, and NULL
+	* there means this value applies.
+	*
+	* Defaults to false: a global workflow runs against events from repos other
+	* than the one that defines it, so it is opt-in by the operator.
+	*/
+	globalWorkflowsEnabled: z.union([z.boolean(), z.string()]).default(false).transform((v) => typeof v === "boolean" ? v : v === "true"),
+	/**
 	* Operator-facing backpressure warning threshold for the dispatch queue.
 	* When pending-queue depth stays at or above this value for at least two
 	* consecutive refresher ticks (~10s), the orchestrator emits a
@@ -11525,6 +11945,7 @@ const baseSchema = z.object({
 	ingestOverflowReplayIntervalMs: z.coerce.number().int().min(1).default(2e3),
 	ingestOverflowReplayBatch: z.coerce.number().int().min(1).default(50),
 	ingestOverflowMaxAttempts: z.coerce.number().int().min(1).default(10),
+	ingestOverflowClaimTimeoutMs: z.coerce.number().int().min(6e4).default(9e5),
 	rerouteSpawnWindowMs: z.coerce.number().int().min(1e3).default(9e4),
 	rerouteAckTimeoutMs: z.coerce.number().int().min(1e3).default(15e3),
 	rerouteMaxHops: z.coerce.number().int().min(1).default(3),
@@ -11851,9 +12272,17 @@ const envDef = defineEnv({
 		lockfileCacheMax: "KICI_LOCKFILE_CACHE_MAX",
 		lockfileCacheTtlMs: "KICI_LOCKFILE_CACHE_TTL_MS",
 		lockfileCacheMaxBytes: "KICI_LOCKFILE_CACHE_MAX_BYTES",
+		contentCacheMax: "KICI_CONTENT_CACHE_MAX",
+		contentCacheTtlMs: "KICI_CONTENT_CACHE_TTL_MS",
+		contentCacheMaxBytes: "KICI_CONTENT_CACHE_MAX_BYTES",
+		globalEvalRoundTimeoutMs: "KICI_GLOBAL_EVAL_ROUND_TIMEOUT_MS",
+		globalEvalCandidateTimeoutMs: "KICI_GLOBAL_EVAL_CANDIDATE_TIMEOUT_MS",
+		globalEvalCacheMax: "KICI_GLOBAL_EVAL_CACHE_MAX",
+		globalEvalWaitTimeoutMs: "KICI_GLOBAL_EVAL_WAIT_TIMEOUT_MS",
 		queueMaxDepth: "KICI_QUEUE_MAX_DEPTH",
 		queueTimeoutMs: "KICI_QUEUE_TIMEOUT_MS",
 		unroutableGraceMs: "KICI_UNROUTABLE_GRACE_MS",
+		globalWorkflowsEnabled: "KICI_GLOBAL_WORKFLOWS_ENABLED",
 		queueBackpressureThreshold: "KICI_QUEUE_BACKPRESSURE_THRESHOLD",
 		workerConcurrency: "KICI_WORKER_CONCURRENCY",
 		concurrencyWaitTimeoutMs: "KICI_CONCURRENCY_WAIT_TIMEOUT_MS",
@@ -11873,6 +12302,7 @@ const envDef = defineEnv({
 		ingestOverflowReplayIntervalMs: "KICI_INGEST_OVERFLOW_REPLAY_INTERVAL_MS",
 		ingestOverflowReplayBatch: "KICI_INGEST_OVERFLOW_REPLAY_BATCH",
 		ingestOverflowMaxAttempts: "KICI_INGEST_OVERFLOW_MAX_ATTEMPTS",
+		ingestOverflowClaimTimeoutMs: "KICI_INGEST_OVERFLOW_CLAIM_TIMEOUT_MS",
 		rerouteSpawnWindowMs: "KICI_REROUTE_SPAWN_WINDOW_MS",
 		rerouteAckTimeoutMs: "KICI_REROUTE_ACK_TIMEOUT_MS",
 		rerouteMaxHops: "KICI_REROUTE_MAX_HOPS",
@@ -13469,6 +13899,27 @@ var DashboardEncryptionKeyRepo = class {
 //#endregion
 //#region src/cluster/cluster-settings-reader.ts
 const logger$9 = createLogger({ prefix: "orch:cluster-settings" });
+/**
+* Ceiling for the three LRU entry-count knobs — `lockfile_cache_max`,
+* `content_cache_max`, and `global_eval_cache_max`.
+*
+* This is a boot-safety bound, not a policy preference. The underlying LRU
+* allocates its index arrays eagerly from `max` — several typed arrays plus the
+* TTL and size arrays the caches ask for — so the cost is paid at construction
+* with zero entries cached. Measured on the shipped version: an empty cache at
+* `max` 5,000,000 costs ~191 MB, and at 5,000,000,000 the constructor throws
+* `RangeError: Invalid array length`.
+*
+* That throw is what makes an unbounded knob dangerous rather than merely
+* wasteful. All three caches are built inside `bootstrapOrchestrator`, so a bad
+* stored value crashes the orchestrator before its admin API is listening —
+* and the admin API is the only way `kici-admin cluster-settings` can reach the
+* stored value. The knob would brick the very tool needed to un-brick it.
+*
+* 100,000 is 200x the shipped default of 500 and costs ~4 MB per empty cache,
+* so it is far above any plausible operator setting while keeping boot bounded.
+*/
+const CACHE_MAX_ENTRIES_CEILING = 1e5;
 const DEFAULT_CACHE_TTL_MS = 1e4;
 /**
 * Reads the single cluster_settings row (id='default') once per short TTL
@@ -13575,6 +14026,29 @@ var ClusterSettingsReader = class {
 		};
 	}
 	/**
+	* Resolve a fleet-wide boolean knob without collapsing a read failure into a
+	* default.
+	*
+	* There is deliberately no `getBoolean(column, fallback)` companion. The
+	* security gate that consumes this must tell the reader's outcomes apart
+	* itself: a stored `false` and a NULL both deny today, but they deny for
+	* different reasons, and `{ ok: false }` must deny regardless of what the
+	* configured default happens to be. A convenience wrapper that folded the
+	* failure into the default would be safe only for as long as that default
+	* stayed `false`. A caller that only needs a display value (the dashboard
+	* status badge) folds `{ ok: false }` into the default explicitly at its own
+	* site, where getting it wrong misreports a badge rather than opening a gate.
+	*/
+	async tryGetBoolean(column) {
+		const { row, readable } = await this.loadSnapshot();
+		if (!readable) return { ok: false };
+		const value = row?.[column];
+		return {
+			ok: true,
+			value: typeof value === "boolean" ? value : null
+		};
+	}
+	/**
 	* The cluster_settings row version last seen in the cache (0 if never loaded).
 	*
 	* Synchronous — never awaits a DB read — so the heartbeat timer can read it
@@ -18145,6 +18619,31 @@ function registerLogsCommand(parent) {
 //#endregion
 //#region src/agent-packaging/node-binary.ts
 /**
+* Fetch a Node dist URL, retrying transient failures. The runtime download is a
+* bootstrap-critical step on a box that may have flaky egress (a fresh customer
+* host, a CDN blip); a single bare `fetch` turns any transient connect/DNS/5xx
+* hiccup into an opaque `fetch failed` that aborts the whole packaging run. We
+* retry connection-level throws and 5xx responses with exponential backoff, and
+* fold the underlying `cause` (e.g. `connect ETIMEDOUT …`, `UND_ERR_…`) into the
+* final error so a genuine failure is diagnosable instead of a bare message.
+*/
+async function fetchNodeDist(url, attempts = 4) {
+	let lastErr;
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		try {
+			const resp = await fetch(url);
+			if (resp.ok) return resp;
+			if (resp.status < 500 || attempt === attempts) throw new Error(`Failed to fetch ${url}: HTTP ${resp.status}`);
+			lastErr = /* @__PURE__ */ new Error(`HTTP ${resp.status}`);
+		} catch (err) {
+			lastErr = err;
+			if (attempt === attempts) throw new Error(`Failed to fetch ${url} after ${attempts} attempts: ${JSON.stringify(serializeError(err))}`);
+		}
+		await setTimeout$1(Math.min(500 * 2 ** (attempt - 1), 4e3));
+	}
+	throw new Error(`Failed to fetch ${url}: ${JSON.stringify(serializeError(lastErr))}`);
+}
+/**
 * Download + SHASUMS256-verify the Node runtime for a glibc-Linux platform and
 * vendor `node` + `npm` into the payload.
 *
@@ -18164,13 +18663,10 @@ async function downloadNodeBinary(opts) {
 	const base = (opts.nodeMirror ?? "https://nodejs.org/dist").replace(/\/$/, "");
 	const filename = `node-v${opts.version}-${nodeOs}-${nodeArch}.tar.gz`;
 	const dir = `v${opts.version}`;
-	const shaResp = await fetch(`${base}/${dir}/SHASUMS256.txt`);
-	if (!shaResp.ok) throw new Error(`Failed to fetch SHASUMS256.txt: ${shaResp.status}`);
-	const shaLine = (await shaResp.text()).split("\n").find((l) => l.endsWith(filename));
+	const shaLine = (await (await fetchNodeDist(`${base}/${dir}/SHASUMS256.txt`)).text()).split("\n").find((l) => l.endsWith(filename));
 	if (!shaLine) throw new Error(`No SHA-256 entry for ${filename} in SHASUMS256.txt`);
 	const expected = shaLine.trim().split(/\s+/)[0];
-	const archiveResp = await fetch(`${base}/${dir}/${filename}`);
-	if (!archiveResp.ok) throw new Error(`Failed to download ${filename}: ${archiveResp.status}`);
+	const archiveResp = await fetchNodeDist(`${base}/${dir}/${filename}`);
 	const buf = Buffer.from(await archiveResp.arrayBuffer());
 	const actual = createHash("sha256").update(buf).digest("hex");
 	if (actual !== expected) throw new Error(`SHA-256 mismatch for ${filename}:\n  expected ${expected}\n  actual   ${actual}`);
@@ -18402,7 +18898,7 @@ async function refreshAgentPackages(storage, version, opts, deps) {
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.3.0";
+	return "0.5.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -20036,7 +20532,7 @@ function formatSettings$1(s, format) {
 	if (format === "json") return JSON.stringify(s, null, 2);
 	const lines = [];
 	lines.push(`Customer/org id:       ${s.customerId}`);
-	lines.push(`Enabled:               ${s.enabled}`);
+	lines.push(`Enabled (cluster-wide): ${s.enabled}`);
 	lines.push(`Allowed authors:       ${s.allowedRepos === null ? "(any repo)" : formatList(s.allowedRepos)}`);
 	lines.push(`Denied source repos:   ${s.deniedRepos === null ? "(none)" : formatList(s.deniedRepos)}`);
 	lines.push(`Elevated authors:      ${s.elevatedRepos === null ? "(none)" : formatList(s.elevatedRepos)}`);
@@ -20094,24 +20590,6 @@ function registerOrgSettingsCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	gw.command("set-enabled <value>").description("Toggle the master enable switch (true|false)").option("--customer-id <id>", "Customer / org id (alias: --org)").option("--org <id>", "Alias for --customer-id").option("--format <format>", "Output format: json|table", "table").action(async (value, opts) => {
-		const enabled = value === "true" ? true : value === "false" ? false : void 0;
-		if (enabled === void 0) {
-			console.error("Error: value must be \"true\" or \"false\"");
-			process.exit(1);
-		}
-		const customerId = resolveCustomerId(opts);
-		try {
-			const settings = await patchSettings$1(getClient(), {
-				customerId,
-				enabled
-			});
-			console.log(formatSettings$1(settings, opts.format));
-		} catch (err) {
-			console.error(`Error: ${toErrorMessage(err)}`);
-			process.exit(1);
-		}
-	});
 	registerListMutators(gw, getClient, "allow", "allowedRepos");
 	registerListMutators(gw, getClient, "deny", "deniedRepos");
 	registerListMutators(gw, getClient, "elevate", "elevatedRepos");
@@ -20787,7 +21265,7 @@ function resolveCustomerId(opts) {
 function label(prefix) {
 	if (prefix === "allow") return "workflow-author allow-list";
 	if (prefix === "deny") return "source-repo deny-list";
-	return "elevated-access list";
+	return "elevated-access list (DEPRECATED: not enforced, removed at v1.0.0)";
 }
 /** Legacy boolean sugar for --op / --enabled: true→permissive, false→disabled. */
 function parseStateToken(token) {
@@ -21045,6 +21523,75 @@ const KNOBS$1 = [
 		flag: "unroutable-grace-ms",
 		min: 0,
 		label: "Unroutable fast-fail grace (ms)"
+	},
+	{
+		field: "ingestOverflowClaimTimeoutMs",
+		flag: "ingest-overflow-claim-timeout-ms",
+		min: 6e4,
+		label: "Ingest queue claim timeout (ms)"
+	},
+	{
+		field: "lockfileCacheMax",
+		flag: "lockfile-cache-max",
+		min: 1,
+		max: CACHE_MAX_ENTRIES_CEILING,
+		label: "Lock-file cache max entries"
+	},
+	{
+		field: "lockfileCacheMaxBytes",
+		flag: "lockfile-cache-max-bytes",
+		min: 1024,
+		label: "Lock-file cache max bytes"
+	},
+	{
+		field: "lockfileCacheTtlMs",
+		flag: "lockfile-cache-ttl-ms",
+		min: 1e3,
+		label: "Lock-file cache TTL (ms)"
+	},
+	{
+		field: "contentCacheMax",
+		flag: "content-cache-max",
+		min: 1,
+		max: CACHE_MAX_ENTRIES_CEILING,
+		label: "Content cache max entries"
+	},
+	{
+		field: "contentCacheMaxBytes",
+		flag: "content-cache-max-bytes",
+		min: 1024,
+		label: "Content cache max bytes"
+	},
+	{
+		field: "contentCacheTtlMs",
+		flag: "content-cache-ttl-ms",
+		min: 1e3,
+		label: "Content cache TTL (ms)"
+	},
+	{
+		field: "globalEvalRoundTimeoutMs",
+		flag: "global-eval-round-timeout-ms",
+		min: 1e3,
+		label: "Global eval round timeout (ms)"
+	},
+	{
+		field: "globalEvalCandidateTimeoutMs",
+		flag: "global-eval-candidate-timeout-ms",
+		min: 1e3,
+		label: "Global eval candidate timeout (ms)"
+	},
+	{
+		field: "globalEvalCacheMax",
+		flag: "global-eval-cache-max",
+		min: 1,
+		max: CACHE_MAX_ENTRIES_CEILING,
+		label: "Global eval round-result cache max entries"
+	},
+	{
+		field: "globalEvalWaitTimeoutMs",
+		flag: "global-eval-wait-timeout-ms",
+		min: 1e3,
+		label: "Global eval wait timeout (ms)"
 	}
 ];
 /** The cluster-global text knobs. */
@@ -21055,6 +21602,11 @@ const STRING_KNOBS = [{
 	expects: "an absolute http(s) URL",
 	validate: (v) => /^https?:\/\/[^\s]+$/.test(v)
 }];
+const BOOLEAN_KNOBS = [{
+	field: "globalWorkflowsEnabled",
+	flag: "global-workflows-enabled",
+	label: "Global workflows enabled"
+}];
 /** Map a Commander long-flag (`--foo-bar`) to its camelCase option key. */
 function optionKey(flag) {
 	return flag.replace(/-([a-z])/g, (_m, c) => c.toUpperCase());
@@ -21062,9 +21614,17 @@ function optionKey(flag) {
 function formatSettings(s, format) {
 	if (format === "json") return JSON.stringify(s, null, 2);
 	const lines = [];
-	const labels = [...KNOBS$1, ...STRING_KNOBS].map((k) => k.label);
+	const labels = [
+		...KNOBS$1,
+		...STRING_KNOBS,
+		...BOOLEAN_KNOBS
+	].map((k) => k.label);
 	const width = Math.max(...labels.map((l) => l.length)) + 2;
-	for (const knob of [...KNOBS$1, ...STRING_KNOBS]) {
+	for (const knob of [
+		...KNOBS$1,
+		...STRING_KNOBS,
+		...BOOLEAN_KNOBS
+	]) {
 		const value = s[knob.field];
 		const shown = value === null || value === void 0 ? "(cluster default)" : String(value);
 		lines.push(`${(knob.label + ":").padEnd(width)} ${shown}`);
@@ -21077,11 +21637,17 @@ async function fetchSettings(client) {
 async function patchSettings(client, body) {
 	return (await client.patch("/api/v1/admin/cluster-settings", body)).settings;
 }
-/** Parse an integer CLI flag with a minimum, exiting with an error on failure. */
-function parseKnobValue(flag, value, min) {
+/**
+* Parse an integer CLI flag against its knob's bounds, exiting on failure.
+*
+* `max` is optional because most knobs have no meaningful ceiling; the ones
+* that do carry a hard boot-safety bound (see {@link KnobSpec.max}).
+*/
+function parseKnobValue(flag, value, min, max) {
 	const n = Number(value);
-	if (!Number.isInteger(n) || n < min) {
-		console.error(`Error: --${flag} must be an integer >= ${min}`);
+	const bounds = max === void 0 ? `>= ${min}` : `between ${min} and ${max}`;
+	if (!Number.isInteger(n) || n < min || max !== void 0 && n > max) {
+		console.error(`Error: --${flag} must be an integer ${bounds}`);
 		process.exit(1);
 	}
 	return n;
@@ -21095,26 +21661,80 @@ function parseStringKnobValue(knob, value) {
 	}
 	return trimmed;
 }
+/**
+* Parse a boolean CLI flag, exiting on failure.
+*
+* Accepts only the exact strings `true` and `false`. A permissive parser (any
+* non-empty string is true) would read `--global-workflows-enabled no` as an
+* enable, which for this knob turns a typo into a security posture change.
+*/
+function parseBooleanKnobValue(knob, value) {
+	const trimmed = value.trim();
+	if (trimmed !== "true" && trimmed !== "false") {
+		console.error(`Error: --${knob.flag} must be true or false`);
+		process.exit(1);
+	}
+	return trimmed === "true";
+}
 /** Assemble the PATCH body from provided `set` flags (exits if none given). */
 function buildClusterPatch(opts) {
 	const patch = {};
 	for (const knob of KNOBS$1) {
 		const raw = opts[optionKey(knob.flag)];
-		if (raw !== void 0) patch[knob.field] = parseKnobValue(knob.flag, raw, knob.min);
+		if (raw !== void 0) patch[knob.field] = parseKnobValue(knob.flag, raw, knob.min, knob.max);
 	}
 	for (const knob of STRING_KNOBS) {
 		const raw = opts[optionKey(knob.flag)];
 		if (raw !== void 0) patch[knob.field] = parseStringKnobValue(knob, raw);
 	}
+	for (const knob of BOOLEAN_KNOBS) {
+		const raw = opts[optionKey(knob.flag)];
+		if (raw !== void 0) patch[knob.field] = parseBooleanKnobValue(knob, raw);
+	}
 	if (Object.keys(patch).length === 0) {
 		console.error(`Error: pass at least one knob flag (e.g. --${KNOBS$1[0].flag} <value>)`);
 		process.exit(1);
 	}
 	return patch;
 }
+/**
+* Warn when only one of the two ordered global-eval timeouts is being set.
+*
+* The orchestrator's wait ceiling must exceed the agent's round budget — the
+* agent's budget starts only once the round job is RUNNING, so a lower ceiling
+* fires on every round that merely waited for a free agent, failing every round
+* silently. The server rejects the pair outright when BOTH effective values are
+* stored, but it cannot compare against a column left NULL: NULL means "the
+* orchestrator's configured default applies", and the route does not know that
+* number. Setting one alone is exactly that blind spot, so warn here.
+*
+* Returns the lines rather than printing them so the check is unit-testable.
+*/
+function unpairedEvalTimeoutWarnings(patch) {
+	const setting = (v) => typeof v === "number";
+	const round = patch.globalEvalRoundTimeoutMs;
+	const warnings = [];
+	const wait = patch.globalEvalWaitTimeoutMs;
+	if (setting(wait) !== setting(round)) {
+		const which = setting(wait) ? "wait timeout" : "round timeout";
+		const other = setting(wait) ? "--global-eval-round-timeout-ms" : "--global-eval-wait-timeout-ms";
+		warnings.push(`Warning: setting the global eval ${which} alone. The wait timeout must stay greater than the round timeout, or every round fails. Check ${other} with \`kici-admin cluster-settings show\`.`);
+	}
+	const candidate = patch.globalEvalCandidateTimeoutMs;
+	if (setting(candidate) !== setting(round)) {
+		const which = setting(candidate) ? "candidate timeout" : "round timeout";
+		const other = setting(candidate) ? "--global-eval-round-timeout-ms" : "--global-eval-candidate-timeout-ms";
+		warnings.push(`Warning: setting the global eval ${which} alone. The candidate timeout must stay less than the round timeout, or one workflow can suppress every other in its round. Check ${other} with \`kici-admin cluster-settings show\`.`);
+	}
+	return warnings;
+}
 /** Build the reset PATCH body: all knobs → null, or just the flagged ones. */
 function buildClusterReset(opts) {
-	const all = [...KNOBS$1, ...STRING_KNOBS];
+	const all = [
+		...KNOBS$1,
+		...STRING_KNOBS,
+		...BOOLEAN_KNOBS
+	];
 	const flagged = all.filter((k) => opts[optionKey(k.flag)]);
 	const target = flagged.length > 0 ? flagged : all;
 	const patch = {};
@@ -21164,10 +21784,15 @@ function registerClusterSettingsCommands(program, getClient) {
 		}
 	});
 	const setCmd = cs.command("set").description("Set one or more cluster-global tunables. At least one knob flag required.").option("--format <format>", "Output format: json|table", "table");
-	for (const knob of KNOBS$1) setCmd.option(`--${knob.flag} <value>`, `${knob.label} (integer >= ${knob.min})`);
+	for (const knob of KNOBS$1) {
+		const bounds = knob.max === void 0 ? `integer >= ${knob.min}` : `integer ${knob.min}-${knob.max}`;
+		setCmd.option(`--${knob.flag} <value>`, `${knob.label} (${bounds})`);
+	}
 	for (const knob of STRING_KNOBS) setCmd.option(`--${knob.flag} <value>`, `${knob.label} (${knob.expects})`);
+	for (const knob of BOOLEAN_KNOBS) setCmd.option(`--${knob.flag} <value>`, `${knob.label} (true|false)`);
 	setCmd.action(async (opts) => {
 		const patch = buildClusterPatch(opts);
+		for (const line of unpairedEvalTimeoutWarnings(patch)) console.warn(line);
 		try {
 			const updated = await patchSettings(getClient(), patch);
 			console.log(formatSettings(updated, opts.format ?? "table"));
@@ -21182,7 +21807,11 @@ function registerClusterSettingsCommands(program, getClient) {
 		}
 	});
 	const resetCmd = cs.command("reset").description("Clear cluster-global overrides (all, or the named knobs) back to cluster defaults").option("--format <format>", "Output format: json|table", "table");
-	for (const knob of [...KNOBS$1, ...STRING_KNOBS]) resetCmd.option(`--${knob.flag}`, `Clear only ${knob.label}`);
+	for (const knob of [
+		...KNOBS$1,
+		...STRING_KNOBS,
+		...BOOLEAN_KNOBS
+	]) resetCmd.option(`--${knob.flag}`, `Clear only ${knob.label}`);
 	resetCmd.action(async (opts) => {
 		const patch = buildClusterReset(opts);
 		try {