@kky42/pievo-server 2.4.14 → 3.0.0

package/.output/server/_ssr/{boot-C472kLwY.mjs → boot-CYRi-wez.mjs}

@@ -1,31 +1,2091 @@
-import { r as __exportAll } from "../_runtime.mjs";
-import { _ as isNotNull, d as and, f as eq, g as inArray, j as sql, m as gte, u as desc, x as lte } from "../_libs/drizzle-orm+postgres.mjs";
+import { o as __toESM, r as __exportAll$1 } from "../_runtime.mjs";
+import { t as Ve } from "../_libs/electric-sql__pglite.mjs";
+import { C as integer, S as jsonb, T as sql, _ as notInArray, a as asc, b as timestamp, c as eq, d as inArray, f as isNotNull, g as ne, h as lte, i as check, l as gt, m as lt, n as index, o as desc, p as isNull, r as uniqueIndex, s as and, t as drizzle, u as gte, v as or, w as boolean, x as text, y as pgTable } from "../_libs/drizzle-orm.mjs";
 import { t as E } from "../_libs/croner.mjs";
-import { $ as getLoop, $t as reclaimRun, A as createLoop, An as updateLoop, At as logger, B as enqueueRun, Bt as parseArtifactSyncBody, C as claimReadyRunForMachine, Cn as sha256Buf, Ct as listLoops, D as countRuns, Dn as stopLoop, Dt as listRuns, E as countRunSnapshots, En as startLoop, F as dbWatchdogFailureThreshold, Ft as machinePresence, Gt as pruneRunSnapshots, H as expirePendingRun, Ht as pauseLoopState, I as dbWatchdogIntervalMs, It as machineReferencesBlob, Jt as putTerminalReportIncidentIfAbsent, K as gcIntervalMs, Kt as putReportReceiptIfAbsent, L as dbWatchdogTimeoutMs, M as dataDir, Mn as upsertConfiguredArtifactFile, Mt as loopIdsWithSnapshots, N as db, Nn as validateLoopTags, Nt as loopsForMachine, P as dbWatchdogEnabled, Pt as machineIdFromToken, Sn as sha256, T as coerceCodingAgent, Tn as snapshotRetention, Tt as listMachines, U as finalizeRunningRun, Ut as prevRunSnapshot, W as forceDeleteLoop, Wt as pruneExpiredLeases, Xt as readConnectKeyBinding, Yt as r2Config, Z as getExactTerminalReportIncident, Zt as readNewIdempotency, _ as blobExists, _n as runningRunForLoop, an as recordRunReportOnce, at as getRunSnapshot, b as blobSizes, cn as releaseAbsentReconciliations, dn as requestDeleteLoop, dt as isDeviceTokenShape, en as reconcileConfiguredArtifacts, et as getMachine, f as acknowledgeRetiredReport, fn as requestRunCancel, gn as runMigrations, h as artifactFileReferencesHash, hn as retireLease, in as recordNewIdempotency, it as getRun, j as createMachine, jn as updateMachine, jt as loginGateEnabled, kn as tryDeleteLoop, kt as liveBlobRefs, lt as initializeCronCadence, m as advanceDueSchedules, mn as resolveLease, on as refreshRunHeartbeats, ot as getTerminalReportIncidents, p as acknowledgeRetiredTerminalIncident, pt as isOutdated, qt as putRunSnapshot, rn as recordBlob, rt as getReportReceipt, s as CODING_AGENTS, sn as rejectTerminalReport, tn as reconcileReclaimedRun, u as TERMINAL_GRACE_MS, un as repairTerminalRunLeases, v as blobGcGraceMs, vn as runningRunsForMachine, vt as isValidHash, w as closeClient, wn as snapshotBlobRefs, x as buildLoopManifest, xn as setMachineOnline, xt as lastRun, y as blobHashesOlderThan, yn as runs, yt as isValidSemver, z as deleteBlob, zt as openRuns } from "./loopTags-CXx5UdGf.mjs";
-import { i as __exportAll$1 } from "./factory-ixUjZqJn.mjs";
+import { t as require_pino } from "../_libs/pino+[...].mjs";
+import { t as require_pino_pretty } from "../_libs/pino-pretty+[...].mjs";
 import { t as createTwoFilesPatch } from "../_libs/diff.mjs";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
 import path from "node:path";
+import os from "node:os";
 import fs$1 from "node:fs/promises";
-//#region node_modules/.nitro/vite/services/ssr/assets/boot-C472kLwY.js
-var boot_C472kLwY_exports = /* @__PURE__ */ __exportAll({
+//#region node_modules/.nitro/vite/services/ssr/assets/loopTags-C6vATFCp.js
+var loopTags_C6vATFCp_exports = /* @__PURE__ */ __exportAll$1({
+	$: () => lastRun,
+	A: () => buildLoopManifest,
+	At: () => runningRunForLoop,
+	B: () => forceDeleteLoop,
+	Bt: () => upsertConfiguredArtifactFile,
+	C: () => acknowledgeRetiredReport,
+	Ct: () => recordRunReportOnce,
+	D: () => blobExists,
+	Dt: () => repairTerminalRunLeases,
+	E: () => artifactFileReferencesHash,
+	Et: () => releaseAbsentReconciliations,
+	F: () => createMachine,
+	Ft: () => stopLoop,
+	G: () => getMachine,
+	Gt: () => CODING_AGENTS,
+	H: () => getArtifactFile,
+	Ht: () => db,
+	I: () => deleteBlob,
+	It: () => store_exports,
+	J: () => getRunSnapshot,
+	Jt: () => logger_exports,
+	K: () => getReportReceipt,
+	Kt: () => coerceCodingAgent,
+	L: () => enqueueRun,
+	Lt: () => tryDeleteLoop,
+	M: () => countRunSnapshots,
+	Mt: () => setMachineOnline,
+	N: () => countRuns,
+	Nt: () => snapshotBlobRefs,
+	O: () => blobHashesOlderThan,
+	Ot: () => requestDeleteLoop,
+	P: () => createLoop,
+	Pt: () => startLoop,
+	Q: () => initializeCronCadence,
+	Qt: () => __exportAll,
+	R: () => expirePendingRun,
+	Rt: () => updateLoop,
+	S: () => sha256Buf,
+	St: () => recordBlob,
+	T: () => advanceDueSchedules,
+	Tt: () => rejectTerminalReport,
+	U: () => getExactTerminalReportIncident,
+	Ut: () => runMigrations,
+	V: () => forceDeleteMachine,
+	Vt: () => closeClient,
+	W: () => getLoop,
+	Wt: () => runs,
+	X: () => hasPendingRun,
+	Xt: () => GC_INTERVAL_MS,
+	Y: () => getTerminalReportIncidents,
+	Yt: () => BLOB_GC_GRACE_MS,
+	Z: () => hasRunningRun,
+	Zt: () => dataDir,
+	_: () => BLOB_CAP,
+	_t: () => recentLoopUsage,
+	a: () => TERMINAL_GRACE_MS,
+	at: () => liveBlobRefs,
+	b: () => parseArtifactSyncBody,
+	bt: () => reconcileReclaimedRun,
+	c: () => machineIdFromToken,
+	ct: () => machineReferencesBlob,
+	d: () => readNewIdempotency,
+	dt: () => pauseLoopState,
+	et: () => listArtifacts,
+	f: () => recordNewIdempotency,
+	ft: () => prevRunSnapshot,
+	g: () => tokens_exports,
+	gt: () => putTerminalReportIncidentIfAbsent,
+	h: () => sha256,
+	ht: () => putRunSnapshot,
+	i: () => machinePresence,
+	it: () => listRunsBefore,
+	j: () => claimReadyRunForMachine,
+	jt: () => runningRunsForMachine,
+	k: () => blobSizes,
+	kt: () => requestRunCancel,
+	l: () => mintDeviceToken,
+	lt: () => openRuns,
+	m: () => retireLease,
+	mt: () => putReportReceiptIfAbsent,
+	n: () => isOutdated,
+	nt: () => listMachines,
+	o: () => connectKeyValid,
+	ot: () => loopIdsWithSnapshots,
+	p: () => resolveLease,
+	pt: () => pruneRunSnapshots,
+	q: () => getRun,
+	qt: () => logger,
+	r: () => isValidSemver,
+	rt: () => listRuns,
+	s: () => isDeviceTokenShape,
+	st: () => loopsForMachine,
+	t: () => validateLoopTags,
+	tt: () => listLoops,
+	u: () => pruneExpiredLeases,
+	ut: () => pauseLoop,
+	v: () => artifacts_exports,
+	vt: () => reclaimRun,
+	w: () => acknowledgeRetiredTerminalIncident,
+	wt: () => refreshRunHeartbeats,
+	x: () => safeRelPath,
+	xt: () => reconciliationStatesForRuns,
+	y: () => isValidHash,
+	yt: () => reconcileConfiguredArtifacts,
+	z: () => finalizeRunningRun,
+	zt: () => updateMachine
+});
+var import_pino = /* @__PURE__ */ __toESM(require_pino());
+var import_pino_pretty = /* @__PURE__ */ __toESM(require_pino_pretty());
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+/**
+* Server data directory: the embedded database (`pgdata/`), artifact bytes
+* (`blobs/`), and the launcher's pid/lock/log files. Kept apart from the
+* daemon's `~/.pievo` so a device running both never mixes their state.
+* Override with `PIEVO_DATA_DIR` (absolute; `~` is not expanded).
+*/
+function dataDir() {
+	return process.env.PIEVO_DATA_DIR?.trim() || path.join(os.homedir(), ".pievo-server");
+}
+/**
+* A blob whose metadata row is younger than this is never collected, so a
+* sync that just wrote a blob can still reference it. A leaked blob is only a
+* storage cost that the next pass reclaims. 1 hour.
+*/
+var BLOB_GC_GRACE_MS = 3600 * 1e3;
+/** Storage-maintenance cadence (prune snapshots, then GC blobs). 15 minutes. */
+var GC_INTERVAL_MS = 900 * 1e3;
+/**
+* Uses pino-pretty as a *synchronous* destination stream (not a worker-thread
+* transport) so logs flush before process.exit() in the one-shot CLIs. Writes to
+* stderr (fd 2) to keep stdout clean for QR codes and human CLI output.
+*/
+var logger_exports = /* @__PURE__ */ __exportAll({ logger: () => logger });
+var level = (process.env.PIEVO_LOG_LEVEL || "info").toLowerCase();
+var stream = (0, import_pino_pretty.default)({
+	destination: 2,
+	colorize: true,
+	translateTime: "SYS:HH:MM:ss",
+	ignore: "pid,hostname"
+});
+var logger = (0, import_pino.default)({ level }, stream);
+/** The coding agent a loop is bound to AND executed with (BYOA on the owner's
+*  machine): `claude-code` → Claude Code, `codex` → `codex exec`, `pi` → Pi.
+*  Non-Claude agents may still have thinner daemon telemetry until stream
+*  integration lands; execution itself is real for every value.
+*
+*  Runtime SINGLE SOURCE (anti-drift): every server consumer DERIVES from this
+*  array — the `CodingAgent` type here, the `db/schema.ts` `CodingAgent` type AND
+*  the `loops.agent` column enum, the edit validator (`coerceCodingAgent`), and the
+*  web agent `<select>` (LoopForm). So widening the set is a one-line edit HERE with
+*  no other server change (the daemon's own enum in `packages/daemon/src/create.ts`
+*  is a separate package, widened alongside). */
+var CODING_AGENTS = [
+	"claude-code",
+	"codex",
+	"pi"
+];
+function coerceCodingAgent(value) {
+	return typeof value === "string" && CODING_AGENTS.includes(value) ? value : null;
+}
+var RESERVED_LOOP_TAGS = [
+	"all loops",
+	"active",
+	"paused",
+	"blocked"
+];
+/**
+* Pievo schema (Drizzle, Postgres `pg-core` dialect, served by embedded PGlite).
+* Pievo is single-user: no row carries an owner. Timestamp values are ISO
+* strings; JSON columns use `jsonb().$type<>()`.
+*/
+/** `skipped`: a pending run retired without executing (pause/retention cleanup,
+*  queue coalescing, or the offline catch-up window elapsed).
+*  Neither success nor failure — excluded from the failure streak (it rides
+*  phase `canceled`, and the streak counts only phase `error`). */
+var machines = pgTable("machines", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	hostname: text("hostname"),
+	platform: text("platform"),
+	arch: text("arch"),
+	daemonVersion: text("daemon_version"),
+	/** Breaking machine protocol last observed on poll. */
+	daemonProtocol: integer("daemon_protocol"),
+	tokenHash: text("token_hash").notNull(),
+	/**
+	* Plaintext device token. Stored so the UI can re-show the connect command
+	* anytime (MVP convenience — deviates from "store only the hash"; acceptable
+	* for a self-hosted control plane where the DB is already the trust root).
+	*/
+	token: text("token"),
+	roots: jsonb("roots").$type(),
+	lastSeen: text("last_seen"),
+	online: boolean("online").notNull().default(false),
+	createdAt: text("created_at").notNull()
+});
+var loops = pgTable("loops", {
+	id: text("id").primaryKey(),
+	/** Execution machine (set at creation; no cross-machine fallback). */
+	machineId: text("machine_id").notNull(),
+	name: text("name").notNull(),
+	tags: text("tags").array().notNull().default(sql`ARRAY[]::text[]`),
+	prompt: text("prompt").notNull(),
+	statusKeep: text("status_keep").notNull(),
+	statusNoChange: text("status_no_change").notNull(),
+	statusBlock: text("status_block").notNull(),
+	/** Exact workdir-relative artifact paths collected by the daemon after provider exit. */
+	artifacts: jsonb("artifacts").$type().notNull().default([]),
+	cron: text("cron").notNull(),
+	scheduleMode: text("schedule_mode", { enum: ["cron", "continuous"] }).notNull(),
+	/** Cron-only overlap behavior. Continuous runs never overlap. */
+	cronOverlap: text("cron_overlap", { enum: ["skip", "queue-one"] }).notNull(),
+	continuousDelayMinutes: integer("continuous_delay_minutes").notNull(),
+	timezone: text("timezone"),
+	workdir: text("workdir").notNull(),
+	/** Durable Stop-before-delete marker. A deleting loop is never claimable. */
+	deleteRequestedAt: timestamp("delete_requested_at", {
+		withTimezone: true,
+		mode: "string"
+	}),
+	pauseCause: jsonb("pause_cause").$type(),
+	model: text("model"),
+	reasoningEffort: text("reasoning_effort"),
+	/** Coding agent this loop is BOUND TO and EXECUTED with: the daemon's
+	*  `buildAgentSpawn` branches on this value (`claude-code` → claude,
+	*  `codex` → `codex exec`, `pi` → Pi print mode). Measured from the creating CLI's env when
+	*  detectable, else the declared/selected value. The text column carries
+	*  both a TypeScript enum and a database CHECK constraint. */
+	agent: text("agent", { enum: CODING_AGENTS }).notNull(),
+	enabled: boolean("enabled").notNull().default(true),
+	nextRunAt: text("next_run_at"),
+	/** The next recurring cadence occurrence not yet materialized as a run. Cron
+	* advances this fact after each due occurrence; continuous clears it on due
+	* and restores it from a successful/error terminal. */
+	nextCadenceAt: text("next_cadence_at"),
+	lastRunIndex: integer("last_run_index").notNull().default(0),
+	createdAt: text("created_at").notNull(),
+	updatedAt: text("updated_at").notNull()
+}, (t) => [
+	index("loops_machine_idx").on(t.machineId),
+	index("delete_requested_loops").on(t.deleteRequestedAt).where(sql`${t.deleteRequestedAt} IS NOT NULL`),
+	check("loops_agent_check", sql`${t.agent} IN ('claude-code', 'codex', 'pi')`),
+	check("loops_tags_count_check", sql`cardinality(${t.tags}) <= 4`),
+	check("loops_tags_reserved_check", sql`NOT (${t.tags} && ARRAY['all loops', 'active', 'paused', 'blocked']::text[])`),
+	check("loops_schedule_mode_check", sql`${t.scheduleMode} IN ('cron', 'continuous')`),
+	check("loops_cron_overlap_check", sql`${t.cronOverlap} IN ('skip', 'queue-one')`)
+]);
+var runs = pgTable("runs", {
+	id: text("id").primaryKey(),
+	loopId: text("loop_id").notNull(),
+	machineId: text("machine_id").notNull(),
+	agent: text("agent", { enum: CODING_AGENTS }),
+	model: text("model"),
+	reasoningEffort: text("reasoning_effort"),
+	runIndex: integer("run_index"),
+	phase: text("phase", { enum: [
+		"pending",
+		"running",
+		"done",
+		"error",
+		"canceled"
+	] }).notNull(),
+	/** Durable queue authority. It only promotes system→owner; diagnostic trigger
+	* reasons, if added later, must never drive lifecycle state. */
+	requestedBy: text("requested_by", { enum: ["owner", "system"] }).notNull().default("system"),
+	ts: text("ts").notNull(),
+	createdAt: text("created_at").notNull().default(sql`CURRENT_TIMESTAMP::text`),
+	updatedAt: text("updated_at").notNull().default(sql`CURRENT_TIMESTAMP::text`),
+	status: text("status", { enum: [
+		"keep",
+		"no-change",
+		"block"
+	] }),
+	message: text("message"),
+	durationMs: integer("duration_ms"),
+	exitCode: integer("exit_code"),
+	finalText: text("final_text"),
+	error: text("error"),
+	sessionId: text("session_id"),
+	usage: jsonb("usage").$type(),
+	/** Monotonic cancellation intent. Running becomes canceled only on daemon report. */
+	cancelRequestedAt: timestamp("cancel_requested_at", {
+		withTimezone: true,
+		mode: "string"
+	}),
+	heartbeatAt: text("heartbeat_at"),
+	reportIncident: jsonb("report_incident").$type()
+}, (t) => [
+	index("runs_loop_idx").on(t.loopId),
+	index("runs_phase_idx").on(t.phase),
+	index("runs_machine_phase_ready_idx").on(t.machineId, t.phase),
+	index("runs_loop_ts_idx").on(t.loopId, t.ts),
+	uniqueIndex("runs_loop_run_index_idx").on(t.loopId, t.runIndex).where(sql`${t.runIndex} IS NOT NULL`),
+	index("runs_loop_terminal_history_idx").on(t.loopId, t.runIndex).where(sql`${t.runIndex} IS NOT NULL AND ${t.phase} IN ('done', 'error', 'canceled')`),
+	uniqueIndex("runs_loop_pending_idx").on(t.loopId).where(sql`${t.phase} = 'pending'`),
+	uniqueIndex("one_running_run_per_loop").on(t.loopId).where(sql`${t.phase} = 'running'`),
+	check("runs_agent_check", sql`${t.agent} IS NULL OR ${t.agent} IN ('claude-code', 'codex', 'pi')`),
+	check("runs_phase_check", sql`${t.phase} IN ('pending', 'running', 'done', 'error', 'canceled')`),
+	check("runs_requested_by_check", sql`${t.requestedBy} IN ('owner', 'system')`),
+	check("runs_status_check", sql`${t.status} IS NULL OR ${t.status} IN ('keep', 'no-change', 'block')`)
+]);
+var runLeases = pgTable("run_leases", {
+	tokenHash: text("token_hash").primaryKey(),
+	runId: text("run_id").notNull(),
+	loopId: text("loop_id").notNull(),
+	machineId: text("machine_id").notNull(),
+	state: text("state", { enum: [
+		"active",
+		"terminal-grace",
+		"reconciliation-only",
+		"retired"
+	] }).notNull().default("active"),
+	/** Null while active/retired; ISO only during terminal-grace. */
+	expiresAt: text("expires_at"),
+	createdAt: text("created_at").notNull()
+}, (t) => [
+	index("run_leases_run_idx").on(t.runId),
+	index("run_leases_loop_idx").on(t.loopId),
+	check("run_leases_state_check", sql`${t.state} IN ('active', 'terminal-grace', 'reconciliation-only', 'retired')`)
+]);
+var runReportReceipts = pgTable("run_report_receipts", {
+	reportId: text("report_id").primaryKey(),
+	runId: text("run_id").notNull(),
+	payloadDigest: text("payload_digest").notNull(),
+	ackStatus: integer("ack_status").notNull(),
+	ackBody: jsonb("ack_body").$type().notNull(),
+	createdAt: timestamp("created_at", {
+		withTimezone: true,
+		mode: "string"
+	}).notNull()
+}, (t) => [index("report_receipts_created").on(t.createdAt)]);
+/** Durable evidence for a rejected terminal attempt. It is keyed by
+* sha256(reportId + canonical-payload-digest), is never loop-owned, and therefore
+* survives loop deletion just like normal report receipts. */
+var terminalReportIncidents = pgTable("terminal_report_incidents", {
+	id: text("id").primaryKey(),
+	runId: text("run_id").notNull(),
+	reportId: text("report_id").notNull(),
+	payloadDigest: text("payload_digest").notNull(),
+	disposition: text("disposition", { enum: ["run-error", "telemetry-rejected"] }).$type().notNull(),
+	ackBody: jsonb("ack_body").$type().notNull(),
+	createdAt: timestamp("created_at", {
+		withTimezone: true,
+		mode: "string"
+	}).notNull()
+}, (t) => [
+	index("terminal_report_incidents_report_id").on(t.reportId),
+	index("terminal_report_incidents_created").on(t.createdAt),
+	check("terminal_report_incidents_disposition_check", sql`${t.disposition} IN ('run-error', 'telemetry-rejected')`)
+]);
+var connectKeys = pgTable("connect_keys", {
+	machineId: text("machine_id").primaryKey(),
+	/** Mint time (ISO) — drives the TTL. */
+	mintedAt: text("minted_at").notNull()
+});
+/**
+* One content-addressed blob (deduped across every loop/run). The bytes live in
+* the byte store under the hash; this row records verified byte presence and size.
+*/
+var blobs = pgTable("blobs", {
+	hash: text("hash").primaryKey(),
+	size: integer("size").notNull(),
+	createdAt: text("created_at").notNull()
+});
+/**
+* The current configured file set of each loop — one row per live or tombstoned
+* relative path. `hash` → `blobs.hash`; null when the file is deleted or oversize
+* (metadata-only, no bytes synced). The
+* unique (loopId, path) index is the upsert key the sync reconciliation drives.
+*/
+var artifactFiles = pgTable("artifact_files", {
+	id: text("id").primaryKey(),
+	loopId: text("loop_id").notNull(),
+	/** Normalized workdir-relative path (never absolute or escaping the workdir). */
+	path: text("path").notNull(),
+	hash: text("hash"),
+	size: integer("size"),
+	/** Bytes contain a NUL (set even for oversize metadata-only files). */
+	binary: boolean("binary").notNull().default(false),
+	/** File exceeds the per-file byte cap → metadata-only (path + size), no blob. */
+	oversize: boolean("oversize").notNull().default(false),
+	deleted: boolean("deleted").notNull().default(false),
+	updatedAt: text("updated_at").notNull()
+}, (t) => [
+	index("artifact_files_loop_idx").on(t.loopId),
+	uniqueIndex("artifact_files_loop_path_idx").on(t.loopId, t.path),
+	index("artifact_files_hash_idx").on(t.hash)
+]);
+/**
+* The loop's full artifact manifest captured at each run's finalize — the input
+* to the per-run diff. Written cheaply on report (no diff computed on write);
+* `getRunDiff` lazily compares run N's snapshot with the preceding snapshot.
+* One row per run (runId primary key).
+*/
+var runSnapshots = pgTable("run_snapshots", {
+	runId: text("run_id").primaryKey(),
+	loopId: text("loop_id").notNull(),
+	manifest: jsonb("manifest").$type().notNull(),
+	createdAt: text("created_at").notNull()
+}, (t) => [index("run_snapshots_loop_idx").on(t.loopId)]);
+/**
+* Embedded PGlite (WASM Postgres) database, file-backed at `<dataDir>/pgdata`,
+* plus the Drizzle handle. A `globalThis` guard keeps the handle a singleton
+* across dev HMR reloads (the Scheduler shares it in-process). Exactly one
+* server process may own a data directory.
+*/
+var schema = {
+	machines,
+	loops,
+	runs,
+	blobs,
+	artifactFiles,
+	runSnapshots,
+	runLeases,
+	runReportReceipts,
+	terminalReportIncidents,
+	connectKeys
+};
+var g$1 = globalThis;
+function open() {
+	if (g$1.__pievoDb && g$1.__pievoClient) return {
+		db: g$1.__pievoDb,
+		client: g$1.__pievoClient
+	};
+	const dir = path.join(dataDir(), "pgdata");
+	logger.info({ pgdata: dir }, "database: pglite");
+	fs.mkdirSync(dataDir(), { recursive: true });
+	const client = new Ve(dir);
+	const db = drizzle(client, { schema });
+	g$1.__pievoClient = client;
+	g$1.__pievoDb = db;
+	return {
+		db,
+		client
+	};
+}
+var opened = open();
+var db = opened.db;
+opened.client;
+/**
+* Migrations dir. In DEV this file lives at `src/db`, so the folder is at the
+* package root (`../../drizzle`). In the BUILT server the module is bundled under
+* `.output/server/{_ssr,_libs}` and `copy-pglite-assets.mjs` lands the folder at
+* `.output/server/drizzle` (`../drizzle`). Return the first candidate that exists
+* so the database migrates in-process from either layout.
+*/
+function migrationsDir() {
+	const here = path.dirname(fileURLToPath(import.meta.url));
+	const devDir = path.resolve(here, "..", "..", "drizzle");
+	const builtDir = path.resolve(here, "..", "drizzle");
+	if (fs.existsSync(devDir)) return devDir;
+	if (fs.existsSync(builtDir)) return builtDir;
+	return devDir;
+}
+/** Apply generated migrations in-process (idempotent). */
+async function runMigrations() {
+	const dir = migrationsDir();
+	if (!fs.existsSync(dir)) return;
+	const { migrate } = await import("../_libs/drizzle-orm.mjs").then((n) => n.E);
+	await migrate(opened.db, { migrationsFolder: dir });
+}
+/**
+* Best-effort clean shutdown of the database client (called from the
+* boot AbortController on SIGINT/SIGTERM). PGlite must be closed explicitly:
+* after migrations it owns a referenced WASM timer that otherwise keeps Node
+* alive until the managed launcher's graceful-stop deadline. Never throws —
+* shutdown must not wedge on a slow drain.
+*/
+async function closeClient() {
+	try {
+		await opened.client.close();
+	} catch {}
+}
+/**
+* Data-access layer over Drizzle. Loop-locked state transitions live here; every
+* DB-touching function is async, while the pure helpers stay sync.
+*/
+var store_exports = /* @__PURE__ */ __exportAll({
+	TERMINAL_REPORT_GRACE_MS: () => TERMINAL_REPORT_GRACE_MS,
+	acknowledgeRetiredReport: () => acknowledgeRetiredReport,
+	acknowledgeRetiredTerminalIncident: () => acknowledgeRetiredTerminalIncident,
+	advanceDueSchedules: () => advanceDueSchedules,
+	artifactFileReferencesHash: () => artifactFileReferencesHash,
+	blobExists: () => blobExists,
+	blobHashesOlderThan: () => blobHashesOlderThan,
+	blobSizes: () => blobSizes,
+	buildLoopManifest: () => buildLoopManifest,
+	claimReadyRunForMachine: () => claimReadyRunForMachine,
+	countRunSnapshots: () => countRunSnapshots,
+	countRuns: () => countRuns,
+	createLoop: () => createLoop,
+	createMachine: () => createMachine,
+	deleteBlob: () => deleteBlob,
+	enqueueRun: () => enqueueRun,
+	expirePendingRun: () => expirePendingRun,
+	finalizeRunningRun: () => finalizeRunningRun,
+	forceDeleteLoop: () => forceDeleteLoop,
+	forceDeleteMachine: () => forceDeleteMachine,
+	getArtifactFile: () => getArtifactFile,
+	getExactTerminalReportIncident: () => getExactTerminalReportIncident,
+	getLoop: () => getLoop,
+	getMachine: () => getMachine,
+	getReportReceipt: () => getReportReceipt,
+	getRun: () => getRun,
+	getRunSnapshot: () => getRunSnapshot,
+	getTerminalReportIncidents: () => getTerminalReportIncidents,
+	hasPendingRun: () => hasPendingRun,
+	hasRunningRun: () => hasRunningRun,
+	initializeCronCadence: () => initializeCronCadence,
+	lastRun: () => lastRun,
+	listArtifacts: () => listArtifacts,
+	listLoops: () => listLoops,
+	listMachines: () => listMachines,
+	listRuns: () => listRuns,
+	listRunsBefore: () => listRunsBefore,
+	liveBlobRefs: () => liveBlobRefs,
+	loopIdsWithSnapshots: () => loopIdsWithSnapshots,
+	loopsForMachine: () => loopsForMachine,
+	machineReferencesBlob: () => machineReferencesBlob,
+	newLoopId: () => newLoopId,
+	nextCronAt: () => nextCronAt,
+	openRuns: () => openRuns,
+	pauseLoop: () => pauseLoop,
+	pauseLoopState: () => pauseLoopState,
+	prevRunSnapshot: () => prevRunSnapshot,
+	pruneRunSnapshots: () => pruneRunSnapshots,
+	putReportReceiptIfAbsent: () => putReportReceiptIfAbsent,
+	putRunSnapshot: () => putRunSnapshot,
+	putTerminalReportIncidentIfAbsent: () => putTerminalReportIncidentIfAbsent,
+	recentLoopUsage: () => recentLoopUsage,
+	reclaimRun: () => reclaimRun,
+	reconcileConfiguredArtifacts: () => reconcileConfiguredArtifacts,
+	reconcileReclaimedRun: () => reconcileReclaimedRun,
+	reconciliationStatesForRuns: () => reconciliationStatesForRuns,
+	recordBlob: () => recordBlob,
+	recordRunReportOnce: () => recordRunReportOnce,
+	refreshRunHeartbeats: () => refreshRunHeartbeats,
+	rejectTerminalReport: () => rejectTerminalReport,
+	releaseAbsentReconciliations: () => releaseAbsentReconciliations,
+	repairTerminalRunLeases: () => repairTerminalRunLeases,
+	requestDeleteLoop: () => requestDeleteLoop,
+	requestRunCancel: () => requestRunCancel,
+	runningRunForLoop: () => runningRunForLoop,
+	runningRunsForMachine: () => runningRunsForMachine,
+	setMachineOnline: () => setMachineOnline,
+	snapshotBlobRefs: () => snapshotBlobRefs,
+	startLoop: () => startLoop,
+	stopLoop: () => stopLoop,
+	terminalIncidentReceiptId: () => terminalIncidentReceiptId,
+	tryDeleteLoop: () => tryDeleteLoop,
+	updateLoop: () => updateLoop,
+	updateMachine: () => updateMachine,
+	upsertConfiguredArtifactFile: () => upsertConfiguredArtifactFile
+});
+function newLoopId() {
+	return `loop-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+}
+function nowIso$1() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+function nextCronAt(cron, timezone, after) {
+	if (!timezone) throw new Error("invariant: cron schedule has no timezone");
+	const probe = new E(cron, {
+		paused: true,
+		timezone
+	});
+	try {
+		const next = probe.nextRun(new Date(after));
+		if (!next) throw new Error(`cron expression never fires again: ${cron}`);
+		return next.toISOString();
+	} finally {
+		probe.stop();
+	}
+}
+function runTimes(at = nowIso$1()) {
+	return {
+		ts: at,
+		createdAt: at,
+		updatedAt: at
+	};
+}
+async function listLoops() {
+	return db.select().from(loops);
+}
+async function getLoop(id) {
+	return (await db.select().from(loops).where(eq(loops.id, id)))[0];
+}
+async function loopsForMachine(machineId) {
+	return db.select().from(loops).where(eq(loops.machineId, machineId));
+}
+async function createLoop(input) {
+	const ts = nowIso$1();
+	const enabled = input.enabled ?? true;
+	if (input.scheduleMode === "cron" && !input.timezone) throw new Error("invariant: cron loop creation requires a timezone");
+	if (input.scheduleMode === "continuous" && input.timezone !== null) throw new Error("invariant: continuous loop creation requires a null timezone");
+	const nextCadenceAt = !enabled ? null : input.scheduleMode === "continuous" ? ts : nextCronAt(input.cron, input.timezone, ts);
+	const row = {
+		...input,
+		enabled,
+		pauseCause: input.pauseCause ?? (!enabled ? {
+			kind: "owner",
+			at: ts
+		} : null),
+		nextRunAt: enabled ? input.nextRunAt ?? null : null,
+		nextCadenceAt,
+		id: input.id ?? newLoopId(),
+		createdAt: ts,
+		updatedAt: ts
+	};
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, input.machineId)).for("key share"))[0]) throw new Error(`machine ${input.machineId} does not exist`);
+		return (await tx.insert(loops).values(row).returning())[0];
+	});
+}
+/** Allocate the next 1-based history number. Every caller already holds the
+* owning loop row lock, so the counter and run transition share one commit. */
+async function allocateRunIndexTx(tx, loopId) {
+	const updated = (await tx.update(loops).set({ lastRunIndex: sql`${loops.lastRunIndex} + 1` }).where(eq(loops.id, loopId)).returning({ runIndex: loops.lastRunIndex }))[0];
+	if (!updated) throw new Error(`cannot allocate history index for missing loop ${loopId}`);
+	return updated.runIndex;
+}
+async function ensureRunIndexTx(tx, run) {
+	return run.runIndex ?? allocateRunIndexTx(tx, run.loopId);
+}
+async function cancelPendingTx(tx, where, message, at) {
+	const pending = await tx.select({
+		id: runs.id,
+		loopId: runs.loopId,
+		runIndex: runs.runIndex
+	}).from(runs).where(where).orderBy(asc(runs.createdAt), asc(runs.id)).for("update");
+	for (const run of pending) {
+		const runIndex = await ensureRunIndexTx(tx, run);
+		await tx.update(runs).set({
+			phase: "canceled",
+			runIndex,
+			message,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, run.id), eq(runs.phase, "pending")));
+	}
+}
+/** Apply one loop patch while its row lock is held. This is shared by owner edits
+* and run-authorized mutations, so cadence semantics cannot drift. */
+async function updateLoopTx(tx, current, patch, at) {
+	const extra = {};
+	if (patch.enabled === true) extra.pauseCause = null;
+	else if (patch.enabled === false && current.enabled && patch.pauseCause === void 0) extra.pauseCause = {
+		kind: "owner",
+		at
+	};
+	const effective = {
+		...current,
+		...patch,
+		...extra
+	};
+	if (current.deleteRequestedAt) extra.enabled = false;
+	const pausing = !effective.enabled || current.deleteRequestedAt != null;
+	const activating = effective.enabled && (patch.enabled === true && !current.enabled || patch.scheduleMode !== void 0 && patch.scheduleMode !== current.scheduleMode);
+	if (pausing) {
+		extra.nextCadenceAt = null;
+		extra.nextRunAt = null;
+	} else if (activating) if (effective.scheduleMode === "cron") extra.nextCadenceAt = nextCronAt(effective.cron, effective.timezone, at);
+	else extra.nextCadenceAt = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, current.id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0] ? null : at;
+	else if (effective.enabled && effective.scheduleMode === "cron" && (patch.cron !== void 0 && patch.cron !== current.cron || patch.timezone !== void 0 && patch.timezone !== current.timezone)) extra.nextCadenceAt = nextCronAt(effective.cron, effective.timezone, at);
+	else if (effective.enabled && effective.scheduleMode === "continuous" && current.nextCadenceAt && Date.parse(current.nextCadenceAt) > Date.parse(at) && patch.continuousDelayMinutes !== void 0 && patch.continuousDelayMinutes !== current.continuousDelayMinutes) {
+		const terminalAt = Date.parse(current.nextCadenceAt) - current.continuousDelayMinutes * 6e4;
+		extra.nextCadenceAt = new Date(terminalAt + effective.continuousDelayMinutes * 6e4).toISOString();
+	}
+	const loop = (await tx.update(loops).set({
+		...patch,
+		...extra,
+		updatedAt: at
+	}).where(eq(loops.id, current.id)).returning())[0];
+	if (patch.enabled === false) await cancelPendingTx(tx, and(eq(runs.loopId, current.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system")), "canceled - loop paused before this system run was claimed", at);
+	if (patch.artifacts !== void 0) {
+		const allowed = new Set(patch.artifacts ?? []);
+		const removed = (await tx.select({
+			id: artifactFiles.id,
+			path: artifactFiles.path
+		}).from(artifactFiles).where(and(eq(artifactFiles.loopId, current.id), eq(artifactFiles.deleted, false)))).filter((file) => !allowed.has(file.path)).map((file) => file.id);
+		if (removed.length) await tx.update(artifactFiles).set({
+			hash: null,
+			deleted: true,
+			updatedAt: at
+		}).where(inArray(artifactFiles.id, removed));
+	}
+	return loop;
+}
+async function updateLoop(id, patch) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		return current ? updateLoopTx(tx, current, patch, nowIso$1()) : void 0;
+	});
+}
+/** Delete loop-owned history/content without erasing durable late-report evidence.
+* A retired lease is non-authorizing and never blocks deletion; only the matching
+* report→410 receipt transaction may consume it. */
+async function deleteLoopDataTx(tx, id) {
+	if (!(await tx.delete(loops).where(eq(loops.id, id)).returning({ id: loops.id })).length) return false;
+	await tx.delete(runs).where(eq(runs.loopId, id));
+	await tx.delete(runLeases).where(and(eq(runLeases.loopId, id), ne(runLeases.state, "retired")));
+	await tx.delete(artifactFiles).where(eq(artifactFiles.loopId, id));
+	await tx.delete(runSnapshots).where(eq(runSnapshots.loopId, id));
+	return true;
+}
+/** Stable Pause plus the post-transition running fact, observed under the same loop
+* lock. Callers use this result for truthful wording without a pre-lock race. */
+async function pauseLoopState(id) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		if (!current) return void 0;
+		const loop = await updateLoopTx(tx, current, { enabled: false }, nowIso$1());
+		const running = (await tx.select().from(runs).where(and(eq(runs.loopId, id), eq(runs.phase, "running"))).limit(1))[0];
+		return {
+			loop,
+			...running ? { running } : {}
+		};
+	});
+}
+async function pauseLoop(id) {
+	return (await pauseLoopState(id))?.loop;
+}
+async function startLoop(id) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		if (!current || current.deleteRequestedAt) return void 0;
+		return updateLoopTx(tx, current, { enabled: true }, nowIso$1());
+	});
+}
+async function stopLoopTx(tx, current, at) {
+	const loop = (await tx.update(loops).set({
+		enabled: false,
+		pauseCause: {
+			kind: "owner",
+			at
+		},
+		nextCadenceAt: null,
+		nextRunAt: null,
+		updatedAt: at
+	}).where(eq(loops.id, current.id)).returning())[0];
+	await cancelPendingTx(tx, and(eq(runs.loopId, current.id), eq(runs.phase, "pending")), "canceled - loop stopped before this queued run was claimed", at);
+	const running = (await tx.select().from(runs).where(and(eq(runs.loopId, current.id), eq(runs.phase, "running"))).limit(1).for("update"))[0];
+	if (!running) return { loop };
+	return {
+		loop,
+		running: running.cancelRequestedAt ? running : (await tx.update(runs).set({
+			cancelRequestedAt: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, running.id), eq(runs.phase, "running"), isNull(runs.cancelRequestedAt))).returning())[0] ?? running
+	};
+}
+async function stopLoop(id) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		return current ? stopLoopTx(tx, current, nowIso$1()) : void 0;
+	});
+}
+async function requestRunCancel(loopId, runId) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: loops.id }).from(loops).where(eq(loops.id, loopId)).for("update"))[0]) return void 0;
+		const run = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId))).limit(1).for("update"))[0];
+		if (!run) return void 0;
+		if (run.phase === "pending") {
+			const at = nowIso$1();
+			const runIndex = await ensureRunIndexTx(tx, run);
+			return (await tx.update(runs).set({
+				phase: "canceled",
+				runIndex,
+				error: "stopped by user",
+				ts: at,
+				updatedAt: at
+			}).where(and(eq(runs.id, runId), eq(runs.phase, "pending"))).returning())[0] ?? run;
+		}
+		if (run.phase === "running" && !run.cancelRequestedAt) {
+			const at = nowIso$1();
+			return (await tx.update(runs).set({
+				cancelRequestedAt: at,
+				updatedAt: at
+			}).where(and(eq(runs.id, runId), eq(runs.phase, "running"), isNull(runs.cancelRequestedAt))).returning())[0] ?? run;
+		}
+		return run;
+	});
+}
+async function requestDeleteLoop(id) {
+	return db.transaction(async (tx) => {
+		let current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		if (!current) return void 0;
+		const at = current.deleteRequestedAt ?? nowIso$1();
+		if (!current.deleteRequestedAt) current = (await tx.update(loops).set({
+			deleteRequestedAt: at,
+			updatedAt: at
+		}).where(eq(loops.id, id)).returning())[0];
+		return stopLoopTx(tx, current, at);
+	});
+}
+async function tryDeleteLoop(id) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0]?.deleteRequestedAt) return false;
+		const open = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0];
+		const authority = (await tx.select({ id: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.loopId, id), inArray(runLeases.state, ["active", "terminal-grace"]))).limit(1))[0];
+		if (open || authority) return false;
+		await tx.update(runLeases).set({
+			state: "retired",
+			expiresAt: null
+		}).where(and(eq(runLeases.loopId, id), eq(runLeases.state, "reconciliation-only")));
+		return deleteLoopDataTx(tx, id);
+	});
+}
+async function forceDeleteLoopTx(tx, id) {
+	if (!(await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0]) return false;
+	await tx.update(runLeases).set({
+		state: "retired",
+		expiresAt: null
+	}).where(and(eq(runLeases.loopId, id), inArray(runLeases.state, [
+		"active",
+		"terminal-grace",
+		"reconciliation-only",
+		"retired"
+	])));
+	return deleteLoopDataTx(tx, id);
+}
+async function forceDeleteLoop(id) {
+	return db.transaction((tx) => forceDeleteLoopTx(tx, id));
+}
+async function enqueueRunTx(tx, loop, request, at) {
+	if (loop.deleteRequestedAt) return {
+		state: "rejected",
+		reason: "loop is being deleted"
+	};
+	if (request.requestedBy !== "owner" && !loop.enabled) return {
+		state: "skipped",
+		reason: "loop is paused"
+	};
+	const pending = (await tx.select().from(runs).where(and(eq(runs.loopId, loop.id), eq(runs.phase, "pending"))).limit(1).for("update"))[0];
+	if (pending) {
+		const requestedBy = pending.requestedBy === "owner" || request.requestedBy === "owner" ? "owner" : "system";
+		const updated = (await tx.update(runs).set({
+			requestedBy,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, pending.id), eq(runs.phase, "pending"))).returning())[0];
+		return updated ? {
+			state: "coalesced",
+			run: updated
+		} : {
+			state: "skipped",
+			reason: "queued run was claimed concurrently"
+		};
+	}
+	const row = {
+		id: randomUUID(),
+		loopId: loop.id,
+		machineId: loop.machineId,
+		phase: "pending",
+		requestedBy: request.requestedBy,
+		...runTimes(at)
+	};
+	return {
+		state: "queued",
+		run: (await tx.insert(runs).values(row).returning())[0]
+	};
+}
+async function failureStreakTx(tx, loopId) {
+	const lastOk = (await tx.select({ runIndex: runs.runIndex }).from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "done"), isNotNull(runs.runIndex))).orderBy(desc(runs.runIndex)).limit(1))[0];
+	const conds = [
+		eq(runs.loopId, loopId),
+		eq(runs.phase, "error"),
+		isNotNull(runs.runIndex)
+	];
+	if (lastOk?.runIndex != null) conds.push(gt(runs.runIndex, lastOk.runIndex));
+	const row = (await tx.select({ n: sql`count(*)` }).from(runs).where(and(...conds)))[0];
+	return Number(row?.n ?? 0);
+}
+async function terminalLifecycleTx(tx, currentLoop, run, terminalAt, loopPatch = {}, failureAutopauseStreak = 0) {
+	const effective = {
+		...currentLoop,
+		...loopPatch
+	};
+	const update = { ...loopPatch };
+	if ((run.phase === "done" || run.phase === "error") && effective.scheduleMode === "continuous") {
+		const openExec = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, currentLoop.id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0];
+		update.nextCadenceAt = effective.enabled && !openExec ? new Date(Date.parse(terminalAt) + Math.max(1, effective.continuousDelayMinutes) * 6e4).toISOString() : null;
+	}
+	let loop = Object.keys(update).length ? (await tx.update(loops).set({
+		...update,
+		updatedAt: terminalAt
+	}).where(eq(loops.id, currentLoop.id)).returning())[0] : currentLoop;
+	let failureStreak = 0;
+	let autoPaused = false;
+	if (run.phase === "done" && run.status === "block") {
+		loop = (await tx.update(loops).set({
+			enabled: false,
+			pauseCause: {
+				kind: "blocked",
+				at: terminalAt,
+				runId: run.id
+			},
+			nextCadenceAt: null,
+			nextRunAt: null,
+			updatedAt: terminalAt
+		}).where(eq(loops.id, currentLoop.id)).returning())[0];
+		await cancelPendingTx(tx, and(eq(runs.loopId, currentLoop.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system")), "canceled - loop auto-paused after a block report", terminalAt);
+		autoPaused = true;
+	}
+	if (run.phase === "error") {
+		failureStreak = await failureStreakTx(tx, currentLoop.id);
+		if (failureAutopauseStreak > 0 && failureStreak >= failureAutopauseStreak && loop.enabled) {
+			loop = (await tx.update(loops).set({
+				enabled: false,
+				pauseCause: {
+					kind: "failure-streak",
+					at: terminalAt,
+					runId: run.id,
+					count: failureStreak
+				},
+				nextCadenceAt: null,
+				nextRunAt: null,
+				updatedAt: terminalAt
+			}).where(eq(loops.id, currentLoop.id)).returning())[0];
+			await cancelPendingTx(tx, and(eq(runs.loopId, currentLoop.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system")), "canceled - loop auto-paused after consecutive failures", terminalAt);
+			autoPaused = true;
+		}
+	}
+	return {
+		loop,
+		failureStreak,
+		autoPaused
+	};
+}
+async function getRun(id) {
+	return (await db.select().from(runs).where(eq(runs.id, id)))[0];
+}
+async function runningRunsForMachine(machineId) {
+	return db.select().from(runs).where(and(eq(runs.machineId, machineId), eq(runs.phase, "running"))).orderBy(asc(runs.createdAt), asc(runs.id));
+}
+async function runningRunForLoop(loopId) {
+	return (await db.select().from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "running"))).limit(1))[0];
+}
+async function getReportReceipt(reportId) {
+	return (await db.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, reportId)))[0];
+}
+function terminalIncidentReceiptId(reportId, payloadDigest) {
+	return createHash("sha256").update(reportId + payloadDigest).digest("hex");
+}
+async function getTerminalReportIncidents(reportId) {
+	return db.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, reportId)).orderBy(asc(terminalReportIncidents.createdAt));
+}
+async function getExactTerminalReportIncident(reportId, payloadDigest) {
+	return (await db.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, terminalIncidentReceiptId(reportId, payloadDigest))))[0];
+}
+async function putTerminalReportIncidentIfAbsent(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		const id = terminalIncidentReceiptId(input.reportId, input.payloadDigest);
+		const existing = (await tx.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, id)).limit(1))[0];
+		if (existing) return existing;
+		return (await tx.insert(terminalReportIncidents).values({
+			id,
+			...input,
+			createdAt: nowIso$1()
+		}).returning())[0];
+	});
+}
+/** Serialize all terminal handling for one reportId, even when the competing
+* runs belong to different loop locks or one terminal result lands in the incident table. */
+async function lockReportIdTx(tx, reportId) {
+	const unsigned = BigInt(`0x${createHash("sha256").update(reportId).digest("hex").slice(0, 16)}`);
+	const key = BigInt.asIntN(64, unsigned).toString();
+	await tx.execute(sql`select pg_advisory_xact_lock(${key}::bigint)`);
+}
+/** Race-safe receipt reservation for definitive non-finalization ACKs (RETIRED).
+* Returns the row that owns reportId, whether inserted here or concurrently. */
+async function putReportReceiptIfAbsent(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		return (await tx.insert(runReportReceipts).values(input).onConflictDoNothing({ target: runReportReceipts.reportId }).returning())[0] ?? (await tx.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, input.reportId)))[0];
+	});
+}
+/** Idempotent startup repair for a crash across terminalization.
+* Terminal runs can never retain active authority. */
+async function repairTerminalRunLeases(now = Date.now()) {
+	const repaired = await db.update(runLeases).set({
+		state: "terminal-grace",
+		expiresAt: new Date(now + TERMINAL_REPORT_GRACE_MS).toISOString()
+	}).where(and(eq(runLeases.state, "active"), sql`exists (select 1 from ${runs} where ${runs.id} = ${runLeases.runId} and ${runs.phase} in ('done', 'error', 'canceled'))`)).returning({ tokenHash: runLeases.tokenHash });
+	await db.update(runLeases).set({ expiresAt: null }).where(eq(runLeases.state, "retired"));
+	return repaired.length;
+}
+/** Atomically persist a definitive 410 and consume only the matching retired
+* tombstone. If the HTTP response is lost, the independent receipt replays it. */
+async function acknowledgeRetiredReport(leaseTokenHash, input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		if (!(await tx.select().from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.state, "retired"))).limit(1).for("update"))[0]) return void 0;
+		await tx.insert(runReportReceipts).values(input).onConflictDoNothing({ target: runReportReceipts.reportId });
+		const stored = (await tx.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, input.reportId)))[0];
+		if (stored?.runId === input.runId && stored.payloadDigest === input.payloadDigest && stored.ackStatus === input.ackStatus) await tx.delete(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.state, "retired")));
+		return stored;
+	});
+}
+/** Refresh provider-neutral liveness in one machine-scoped UPDATE. Untrusted ids
+* cannot stamp another machine or a non-running row; fresh stamps stay untouched. */
+async function refreshRunHeartbeats(machineId, runIds, at, staleBefore) {
+	if (!runIds.length) return 0;
+	return (await db.update(runs).set({
+		heartbeatAt: at,
+		updatedAt: at
+	}).where(and(eq(runs.machineId, machineId), eq(runs.phase, "running"), inArray(runs.id, runIds), or(isNull(runs.heartbeatAt), lt(runs.heartbeatAt, staleBefore)))).returning({ id: runs.id })).length;
+}
+async function activeRunForReportTx(tx, loopId, runId, leaseTokenHash) {
+	const lease = (await tx.select().from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.runId, runId), eq(runLeases.loopId, loopId), eq(runLeases.state, "active"))).limit(1).for("update"))[0];
+	if (!lease) return { state: "invalid-lease" };
+	const run = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.machineId, lease.machineId), eq(runs.phase, "running"))).limit(1).for("update"))[0];
+	return run ? {
+		state: "active",
+		run
+	} : { state: "run-not-running" };
+}
+/** Record the agent-authored status/message exactly once. The loop row is the
+* serialization point, so sequential and concurrent duplicate callbacks both
+* lose before any field can be overwritten. */
+async function recordRunReportOnce(input) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: loops.id }).from(loops).where(eq(loops.id, input.loopId)).for("update"))[0]) return { state: "missing-loop" };
+		const active = await activeRunForReportTx(tx, input.loopId, input.runId, input.leaseTokenHash);
+		if (active.state !== "active") return active;
+		if (active.run.status != null || active.run.message != null) return { state: "already-reported" };
+		const at = nowIso$1();
+		const run = (await tx.update(runs).set({
+			status: input.status,
+			message: input.message,
+			updatedAt: at
+		}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, "running"), isNull(runs.status), isNull(runs.message))).returning())[0];
+		return run ? {
+			state: "applied",
+			run
+		} : { state: "already-reported" };
+	});
+}
+async function finalizeTerminalRunTx(tx, input) {
+	if (input.receipt) await lockReportIdTx(tx, input.receipt.reportId);
+	const current = (await tx.select().from(loops).where(eq(loops.id, input.loopId)).for("update"))[0];
+	if (!current) return void 0;
+	if (input.receipt) {
+		if ((await tx.select({ id: terminalReportIncidents.id }).from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, input.receipt.reportId)).limit(1))[0]) return void 0;
+	}
+	const leaseState = input.leaseCheck ? await input.leaseCheck(tx) : void 0;
+	if (input.leaseCheck && !leaseState) return void 0;
+	const target = (await tx.select().from(runs).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, input.runPhase))).limit(1).for("update"))[0];
+	if (!target) return void 0;
+	const runIndex = await ensureRunIndexTx(tx, target);
+	const at = typeof input.runPatch.ts === "string" ? input.runPatch.ts : nowIso$1();
+	const run = (await tx.update(runs).set({
+		...input.runPatch,
+		runIndex,
+		updatedAt: at
+	}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, input.runPhase))).returning())[0];
+	if (!run) return void 0;
+	const lifecycle = leaseState === "reconciliation-only" ? {
+		loop: current,
+		failureStreak: 0,
+		autoPaused: false
+	} : await terminalLifecycleTx(tx, current, run, at, input.loopPatch, input.failureAutopauseStreak);
+	if (input.leaseTokenHash) await tx.delete(runLeases).where(eq(runLeases.runId, input.runId));
+	if (input.receipt) await tx.insert(runReportReceipts).values(input.receipt);
+	return {
+		run,
+		...lifecycle,
+		...input.reconciliation ? { reportOnly: leaseState === "reconciliation-only" } : {}
+	};
+}
+async function reclaimedLeaseStateTx(tx, loopId, runId, leaseTokenHash) {
+	const leaseNow = nowIso$1();
+	const lease = (await tx.select({ state: runLeases.state }).from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.runId, runId), eq(runLeases.loopId, loopId), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), gt(runLeases.expiresAt, leaseNow))).limit(1).for("update"))[0];
+	return lease?.state === "terminal-grace" || lease?.state === "reconciliation-only" ? lease.state : void 0;
+}
+/** Consume a retired tombstone when its reportId is owned by another run.
+* The run/loop may already be deleted, so only the exact incident receipt and
+* lease tombstone participate in this transaction. */
+async function acknowledgeRetiredTerminalIncident(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		const id = terminalIncidentReceiptId(input.reportId, input.payloadDigest);
+		const replay = (await tx.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, id)).limit(1))[0];
+		const lease = (await tx.select({ tokenHash: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.tokenHash, input.leaseTokenHash), eq(runLeases.runId, input.runId), eq(runLeases.state, "retired"))).limit(1).for("update"))[0];
+		if (!lease) return void 0;
+		if (replay) {
+			await tx.delete(runLeases).where(eq(runLeases.tokenHash, lease.tokenHash));
+			return replay;
+		}
+		const receipt = (await tx.insert(terminalReportIncidents).values({
+			id,
+			runId: input.runId,
+			reportId: input.reportId,
+			payloadDigest: input.payloadDigest,
+			disposition: "telemetry-rejected",
+			ackBody: input.ackBody,
+			createdAt: nowIso$1()
+		}).returning())[0];
+		await tx.delete(runLeases).where(eq(runLeases.tokenHash, lease.tokenHash));
+		return receipt;
+	});
+}
+/** Reject one correlatable terminal attempt as a durable terminal fact. Authority,
+* run/loop lifecycle, incident receipt, and lease consumption share one transaction.
+* No payload-authored cursor/task/message field is accepted here. */
+async function rejectTerminalReport(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		const current = (await tx.select().from(loops).where(eq(loops.id, input.loopId)).for("update"))[0];
+		if (!current) return { state: "missing-loop" };
+		const normal = (await tx.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, input.reportId)))[0];
+		if (normal?.runId === input.runId) return {
+			state: "normal-replay",
+			receipt: normal
+		};
+		const priorIncident = (await tx.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, terminalIncidentReceiptId(input.reportId, input.payloadDigest))).limit(1))[0];
+		if (priorIncident?.runId === input.runId) return {
+			state: "incident-replay",
+			receipt: priorIncident
+		};
+		const now = nowIso$1();
+		const leaseConditions = [
+			eq(runLeases.tokenHash, input.leaseTokenHash),
+			eq(runLeases.runId, input.runId),
+			eq(runLeases.loopId, input.loopId),
+			input.leaseState === "active" ? eq(runLeases.state, "active") : inArray(runLeases.state, ["terminal-grace", "reconciliation-only"])
+		];
+		if (input.leaseState !== "active") leaseConditions.push(gt(runLeases.expiresAt, now));
+		const lease = (await tx.select().from(runLeases).where(and(...leaseConditions)).limit(1).for("update"))[0];
+		if (!lease) return { state: "invalid-lease" };
+		const receiptInput = {
+			id: terminalIncidentReceiptId(input.reportId, input.payloadDigest),
+			runId: input.runId,
+			reportId: input.reportId,
+			payloadDigest: input.payloadDigest,
+			disposition: input.disposition,
+			ackBody: input.ackBody,
+			createdAt: input.incident.at
+		};
+		if (lease.state !== "active") {
+			const run = (await tx.update(runs).set({
+				reportIncident: input.incident,
+				updatedAt: input.incident.at
+			}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), inArray(runs.phase, [
+				"done",
+				"error",
+				"canceled"
+			]))).returning())[0];
+			if (!run) return { state: "run-not-terminalizable" };
+			await tx.delete(runLeases).where(eq(runLeases.tokenHash, input.leaseTokenHash));
+			return {
+				state: "telemetry-rejected",
+				run,
+				loop: current,
+				receipt: priorIncident ?? (await tx.insert(terminalReportIncidents).values(receiptInput).returning())[0],
+				failureStreak: 0,
+				autoPaused: false
+			};
+		}
+		const target = (await tx.select().from(runs).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, "running"))).limit(1).for("update"))[0];
+		if (!target) return { state: "run-not-terminalizable" };
+		const runIndex = await ensureRunIndexTx(tx, target);
+		const run = (await tx.update(runs).set({
+			phase: "error",
+			runIndex,
+			error: input.incident.reason,
+			reportIncident: input.incident,
+			ts: input.incident.at,
+			updatedAt: input.incident.at
+		}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, "running"))).returning())[0];
+		if (!run) return { state: "run-not-terminalizable" };
+		const lifecycle = await terminalLifecycleTx(tx, current, run, input.incident.at, {}, input.failureAutopauseStreak ?? 0);
+		await tx.delete(runLeases).where(eq(runLeases.tokenHash, input.leaseTokenHash));
+		const receipt = priorIncident ?? (await tx.insert(terminalReportIncidents).values(receiptInput).returning())[0];
+		return {
+			state: "run-error",
+			run,
+			...lifecycle,
+			receipt
+		};
+	});
+}
+/** Atomically CAS running→terminal and apply the report's loop patch.
+* The loop patch is unreachable when cancel/reclaim/another report won. */
+async function finalizeRunningRun(loopId, runId, runPatch, loopPatch = {}, leaseTokenHash, failureAutopauseStreak = 0, receipt) {
+	return db.transaction(async (tx) => {
+		return finalizeTerminalRunTx(tx, {
+			loopId,
+			runId,
+			runPhase: "running",
+			runPatch,
+			loopPatch,
+			leaseTokenHash,
+			leaseCheck: leaseTokenHash ? async (lockedTx) => {
+				return (await activeRunForReportTx(lockedTx, loopId, runId, leaseTokenHash)).state === "active" ? "active" : void 0;
+			} : void 0,
+			failureAutopauseStreak,
+			receipt
+		});
+	});
+}
+/** Sweep reclaim under the same loop lock as claim/report/cancel. Running
+* reclaims terminalize their lease and write the provisional continuous cadence
+* fact atomically; pending reclaims have no lease. */
+async function reclaimRun(runId, expected, reason, at = nowIso$1(), graceMs = 1440 * 60 * 1e3, failureAutopauseStreak = 0) {
+	return db.transaction(async (tx) => {
+		const observed = (await tx.select({ loopId: runs.loopId }).from(runs).where(eq(runs.id, runId)).limit(1))[0];
+		if (!observed) return void 0;
+		const loop = (await tx.select().from(loops).where(eq(loops.id, observed.loopId)).for("update"))[0];
+		if (!loop) return void 0;
+		const currentRun = (await tx.select().from(runs).where(eq(runs.id, runId)).limit(1).for("update"))[0];
+		if (currentRun?.phase !== expected) return void 0;
+		if (expected === "running") await tx.update(runLeases).set({
+			state: "terminal-grace",
+			expiresAt: new Date(Date.parse(at) + graceMs).toISOString()
+		}).where(and(eq(runLeases.runId, runId), eq(runLeases.state, "active")));
+		const runIndex = await ensureRunIndexTx(tx, currentRun);
+		const reclaimed = (await tx.update(runs).set({
+			phase: "error",
+			runIndex,
+			error: reason,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, runId), eq(runs.phase, expected))).returning())[0];
+		if (!reclaimed) return void 0;
+		return {
+			run: reclaimed,
+			...await terminalLifecycleTx(tx, loop, reclaimed, at, {}, failureAutopauseStreak)
+		};
+	});
+}
+/** A daemon's completed recovery snapshot is authoritative for execution
+* exclusion. Reclaimed runs absent from that snapshot retain late-report authority
+* until their original expiry, but stop blocking queued work immediately. */
+async function releaseAbsentReconciliations(machineId, recoverableRunIds, at = nowIso$1()) {
+	const conditions = [
+		eq(runLeases.machineId, machineId),
+		eq(runLeases.state, "terminal-grace"),
+		gt(runLeases.expiresAt, at)
+	];
+	const ids = [...new Set(recoverableRunIds)];
+	if (ids.length) conditions.push(notInArray(runLeases.runId, ids));
+	return (await db.update(runLeases).set({ state: "reconciliation-only" }).where(and(...conditions)).returning({ runId: runLeases.runId })).map((row) => row.runId);
+}
+/** Consume one terminal reconciliation lease and reconcile its reclaimed error
+* exactly once. Keeping the lease check/delete beside the run + loop writes closes the
+* error→error double-report hole where a phase CAS alone cannot distinguish the
+* first real failure from a second concurrent one. */
+async function reconcileReclaimedRun(loopId, runId, leaseTokenHash, runPatch, loopPatch = {}, failureAutopauseStreak = 0, receipt) {
+	return db.transaction(async (tx) => {
+		return finalizeTerminalRunTx(tx, {
+			loopId,
+			runId,
+			runPhase: "error",
+			runPatch,
+			loopPatch,
+			leaseTokenHash,
+			leaseCheck: (lockedTx) => reclaimedLeaseStateTx(lockedTx, loopId, runId, leaseTokenHash),
+			failureAutopauseStreak,
+			receipt,
+			reconciliation: true
+		});
+	});
+}
+var TERMINAL_REPORT_GRACE_MS = 600 * 1e3;
+/**
+* The durable run-queue write seam. It serializes on the loop row and owns every
+* queue invariant callers would otherwise have to reproduce:
+*  - at most one ordinary pending row per loop (also backed by a partial unique index),
+*  - a running run may retain one coalesced follow-up,
+*  - owner authority promotes an existing system row and never downgrades,
+*  - paused loops accept owner Run-once work while recurring system work stays stopped.
+*/
+async function enqueueRun(loopId, request) {
+	return db.transaction(async (tx) => {
+		const loop = (await tx.select().from(loops).where(eq(loops.id, loopId)).for("update"))[0];
+		if (!loop) return {
+			state: "rejected",
+			reason: "loop not found"
+		};
+		return enqueueRunTx(tx, loop, request, nowIso$1());
+	});
+}
+/** Materialize every due schedule fact. Each loop is locked and rechecked in its
+* own transaction; cadence and one-shot facts may coalesce into one system exec
+* and are consumed together. */
+async function advanceDueSchedules(at = nowIso$1(), filter = {}) {
+	const due = or(and(isNotNull(loops.nextCadenceAt), sql`${loops.nextCadenceAt} <= ${at}`), and(isNotNull(loops.nextRunAt), sql`${loops.nextRunAt} <= ${at}`));
+	const candidates = await db.select({ id: loops.id }).from(loops).where(and(eq(loops.enabled, true), isNull(loops.deleteRequestedAt), due, filter.loopId ? eq(loops.id, filter.loopId) : void 0, filter.machineId ? eq(loops.machineId, filter.machineId) : void 0));
+	const advanced = [];
+	for (const { id } of candidates) {
+		const result = await db.transaction(async (tx) => {
+			const loop = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+			if (!loop?.enabled || loop.deleteRequestedAt) return void 0;
+			const cadenceDue = !!loop.nextCadenceAt && Date.parse(loop.nextCadenceAt) <= Date.parse(at);
+			const oneShotDue = !!loop.nextRunAt && Date.parse(loop.nextRunAt) <= Date.parse(at);
+			if (!cadenceDue && !oneShotDue) return void 0;
+			if ((await tx.select({ tokenHash: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.loopId, id), eq(runLeases.state, "terminal-grace"), gt(runLeases.expiresAt, at))).limit(1))[0]) return void 0;
+			const open = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0];
+			const skipRecurring = cadenceDue && !!open && (loop.scheduleMode === "continuous" || loop.cronOverlap === "skip");
+			const queued = oneShotDue || !skipRecurring ? await enqueueRunTx(tx, loop, { requestedBy: "system" }, at) : void 0;
+			if (queued && !("run" in queued)) return void 0;
+			const nextCadenceAt = cadenceDue ? loop.scheduleMode === "cron" ? nextCronAt(loop.cron, loop.timezone, at) : null : loop.nextCadenceAt;
+			const updatedLoop = (await tx.update(loops).set({
+				nextCadenceAt,
+				...oneShotDue ? { nextRunAt: null } : {},
+				updatedAt: at
+			}).where(eq(loops.id, id)).returning())[0];
+			return queued ? {
+				loop: updatedLoop,
+				run: queued.run,
+				state: queued.state
+			} : {
+				loop: updatedLoop,
+				state: "skipped"
+			};
+		});
+		if (result) advanced.push(result);
+	}
+	return advanced;
+}
+/** Conservative boot initialization for pre-fact cron rows. No history lookup and
+* no missed-fire catch-up: only install the next future occurrence. */
+async function initializeCronCadence(at = nowIso$1()) {
+	const candidates = await db.select({ id: loops.id }).from(loops).where(and(eq(loops.enabled, true), isNull(loops.deleteRequestedAt), eq(loops.scheduleMode, "cron"), isNull(loops.nextCadenceAt)));
+	const initialized = [];
+	for (const { id } of candidates) {
+		const loop = await db.transaction(async (tx) => {
+			const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+			if (!current?.enabled || current.scheduleMode !== "cron" || current.nextCadenceAt) return void 0;
+			return (await tx.update(loops).set({
+				nextCadenceAt: nextCronAt(current.cron, current.timezone, at),
+				updatedAt: at
+			}).where(eq(loops.id, id)).returning())[0];
+		});
+		if (loop) initialized.push(loop);
+	}
+	return initialized;
+}
+/** Claim one ready loop and mint its lease atomically. Repeated polls may add
+* unlimited cross-loop concurrency; the loop index remains the final same-loop
+* serialization invariant. Reported local runs exclude their loops even if the
+* server has already terminalized an older process. */
+async function claimReadyRunForMachine(machineId, at = nowIso$1(), excludeRunIds = []) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, machineId)).for("update"))[0]) return void 0;
+		const excludedLoops = /* @__PURE__ */ new Set();
+		if (excludeRunIds.length) {
+			const rows = await tx.select({ loopId: runs.loopId }).from(runs).where(and(eq(runs.machineId, machineId), inArray(runs.id, [...new Set(excludeRunIds)])));
+			for (const row of rows) excludedLoops.add(row.loopId);
+		}
+		const next = (await tx.select({
+			run: runs,
+			loop: loops
+		}).from(runs).innerJoin(loops, eq(loops.id, runs.loopId)).where(and(eq(runs.machineId, machineId), eq(runs.phase, "pending"), isNull(runs.cancelRequestedAt), or(eq(loops.enabled, true), eq(runs.requestedBy, "owner")), isNull(loops.deleteRequestedAt), excludedLoops.size ? notInArray(loops.id, [...excludedLoops]) : void 0, sql`not exists (select 1 from runs occupied where occupied.loop_id = ${loops.id} and occupied.phase = 'running')`, sql`not exists (select 1 from run_leases authority where authority.loop_id = ${loops.id} and (authority.state = 'active' or (authority.state = 'terminal-grace' and authority.expires_at > ${at})))`)).orderBy(asc(runs.createdAt), asc(runs.id)).limit(1))[0];
+		if (!next) return void 0;
+		let loop = (await tx.select().from(loops).where(eq(loops.id, next.loop.id)).for("update"))[0];
+		const candidate = (await tx.select().from(runs).where(eq(runs.id, next.run.id)).limit(1).for("update"))[0];
+		if (!loop || !candidate || candidate.phase !== "pending" || candidate.cancelRequestedAt || loop.deleteRequestedAt || !loop.enabled && candidate.requestedBy !== "owner") return void 0;
+		const occupied = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, loop.id), eq(runs.phase, "running"))).limit(1))[0];
+		const authority = (await tx.select({ tokenHash: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.loopId, loop.id), inArray(runLeases.state, ["active", "terminal-grace"]), or(eq(runLeases.state, "active"), gt(runLeases.expiresAt, at)))).limit(1))[0];
+		if (occupied || authority) return void 0;
+		const runIndex = await ensureRunIndexTx(tx, candidate);
+		const run = (await tx.update(runs).set({
+			phase: "running",
+			runIndex,
+			agent: loop.agent,
+			model: loop.model,
+			reasoningEffort: loop.reasoningEffort,
+			heartbeatAt: null,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, candidate.id), eq(runs.phase, "pending"), isNull(runs.cancelRequestedAt))).returning())[0];
+		if (!run) return void 0;
+		if (loop.scheduleMode === "continuous" && loop.nextCadenceAt != null) loop = (await tx.update(loops).set({
+			nextCadenceAt: null,
+			updatedAt: at
+		}).where(eq(loops.id, loop.id)).returning())[0];
+		const runToken = `rk_${randomBytes(16).toString("hex")}`;
+		const tokenHash = createHash("sha256").update(runToken).digest("hex");
+		await tx.insert(runLeases).values({
+			tokenHash,
+			runId: run.id,
+			loopId: loop.id,
+			machineId,
+			createdAt: at
+		});
+		return {
+			run,
+			loop,
+			runToken
+		};
+	});
+}
+async function listRuns(loopId, limit = 30) {
+	return (await db.select().from(runs).where(eq(runs.loopId, loopId)).orderBy(desc(runs.ts)).limit(limit)).reverse();
+}
+async function reconciliationStatesForRuns(loopId, runIds, at = nowIso$1()) {
+	if (!runIds.length) return /* @__PURE__ */ new Map();
+	const rows = await db.select({
+		runId: runLeases.runId,
+		state: runLeases.state
+	}).from(runLeases).where(and(eq(runLeases.loopId, loopId), inArray(runLeases.runId, [...new Set(runIds)]), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), gt(runLeases.expiresAt, at)));
+	return new Map(rows.map((row) => [row.runId, row.state === "terminal-grace" ? "blocking" : "report-only"]));
+}
+/** One older page: runs strictly before `beforeTs`, newest-first then capped,
+*  returned chronological (oldest-first) to match listRuns. Cursor-based (by ts,
+*  not offset) so it's stable while new runs land at the head. */
+async function listRunsBefore(loopId, beforeTs, limit = 16) {
+	return (await db.select().from(runs).where(and(eq(runs.loopId, loopId), lt(runs.ts, beforeTs))).orderBy(desc(runs.ts)).limit(limit)).reverse();
+}
+async function lastRun(loopId) {
+	return (await db.select().from(runs).where(eq(runs.loopId, loopId)).orderBy(desc(runs.ts)).limit(1))[0];
+}
+async function countRuns(loopId) {
+	const r = (await db.select({ n: sql`count(*)` }).from(runs).where(eq(runs.loopId, loopId)))[0];
+	return Number(r?.n ?? 0);
+}
+async function recentLoopUsage(loopId, since) {
+	const row = (await db.select({
+		runCount: sql`count(*)`,
+		tokenCount: sql`coalesce(sum(
+        coalesce((${runs.usage} ->> 'inputTokens')::bigint, 0) +
+        coalesce((${runs.usage} ->> 'outputTokens')::bigint, 0)
+      ), 0)`
+	}).from(runs).where(and(eq(runs.loopId, loopId), sql`${runs.ts} >= ${since}`)))[0];
+	return {
+		runCount: Number(row?.runCount ?? 0),
+		tokenCount: Number(row?.tokenCount ?? 0)
+	};
+}
+async function openRuns() {
+	return db.select().from(runs).where(inArray(runs.phase, ["pending", "running"]));
+}
+async function hasRunningRun(loopId) {
+	return !!(await db.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "running"))).limit(1))[0];
+}
+async function hasPendingRun(loopId) {
+	return !!(await db.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "pending"))).limit(1))[0];
+}
+/** Expire one offline system row only if the sweep snapshot is still exact and
+* its immutable lifetime remains over the cap under the loop lock. */
+async function expirePendingRun(runId, expected, at, maxLifetimeMs, message) {
+	return db.transaction(async (tx) => {
+		const observed = (await tx.select({ loopId: runs.loopId }).from(runs).where(eq(runs.id, runId)).limit(1))[0];
+		if (!observed) return false;
+		const loop = (await tx.select({ id: loops.id }).from(loops).where(eq(loops.id, observed.loopId)).for("update"))[0];
+		if (!loop) return false;
+		const current = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loop.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system"), eq(runs.requestedBy, expected.requestedBy), eq(runs.updatedAt, expected.updatedAt))).limit(1).for("update"))[0];
+		if (!current || Date.parse(at) - Date.parse(current.createdAt) <= maxLifetimeMs) return false;
+		if ((await tx.select({ online: machines.online }).from(machines).where(eq(machines.id, current.machineId)).limit(1))[0]?.online) return false;
+		const runIndex = await ensureRunIndexTx(tx, current);
+		return (await tx.update(runs).set({
+			phase: "canceled",
+			runIndex,
+			message,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, runId), eq(runs.phase, "pending"), eq(runs.requestedBy, "system"), eq(runs.updatedAt, expected.updatedAt))).returning({ id: runs.id })).length > 0;
+	});
+}
+async function listMachines() {
+	return db.select().from(machines).orderBy(asc(machines.name), asc(machines.id));
+}
+async function getMachine(id) {
+	return (await db.select().from(machines).where(eq(machines.id, id)))[0];
+}
+async function createMachine(input) {
+	return (await db.insert(machines).values({
+		...input,
+		createdAt: nowIso$1()
+	}).returning())[0];
+}
+async function updateMachine(id, patch) {
+	await db.update(machines).set(patch).where(eq(machines.id, id));
+	return getMachine(id);
+}
+/** Atomically retire all loop authority, remove server-owned machine data, revoke
+* enrollment, and delete the machine. */
+async function forceDeleteMachine(id) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, id)).for("update"))[0]) return { state: "not-found" };
+		const ownedLoops = await tx.select().from(loops).where(eq(loops.machineId, id)).for("update");
+		for (const loop of ownedLoops) if (!await forceDeleteLoopTx(tx, loop.id)) throw new Error(`failed to delete loop ${loop.id}`);
+		await tx.delete(connectKeys).where(eq(connectKeys.machineId, id));
+		await tx.delete(machines).where(eq(machines.id, id));
+		return {
+			state: "deleted",
+			loopIds: ownedLoops.map((loop) => loop.id)
+		};
+	});
+}
+async function setMachineOnline(id, online) {
+	await db.update(machines).set({
+		online,
+		lastSeen: nowIso$1()
+	}).where(eq(machines.id, id));
+}
+async function blobExists(hash) {
+	return !!(await db.select({ hash: blobs.hash }).from(blobs).where(eq(blobs.hash, hash)))[0];
+}
+/** Verified byte lengths recorded at blob ingress, used to budget reads before
+* touching the byte store. Missing metadata is intentionally not estimated. */
+async function blobSizes(hashes) {
+	if (!hashes.length) return /* @__PURE__ */ new Map();
+	const rows = await db.select({
+		hash: blobs.hash,
+		size: blobs.size
+	}).from(blobs).where(inArray(blobs.hash, [...new Set(hashes)]));
+	return new Map(rows.map((row) => [row.hash, row.size]));
+}
+async function recordBlob(hash, size) {
+	await db.insert(blobs).values({
+		hash,
+		size,
+		createdAt: nowIso$1()
+	}).onConflictDoNothing();
+}
+/** Does any LIVE artifact_files row on a loop bound to `machineId` point at `hash`?
+*  Gates putBlob: a device may only upload bytes the sync handshake actually asked
+*  it for (a row a prior sync wrote for one of ITS loops), never arbitrary
+*  self-hashed blobs — otherwise any device token is an uncapped blob write channel. */
+async function machineReferencesBlob(machineId, hash) {
+	return !!(await db.select({ id: artifactFiles.id }).from(artifactFiles).innerJoin(loops, eq(artifactFiles.loopId, loops.id)).where(and(eq(loops.machineId, machineId), eq(artifactFiles.hash, hash), eq(artifactFiles.deleted, false), sql`${loops.artifacts} @> jsonb_build_array(${artifactFiles.path})`)).limit(1))[0];
+}
+async function writeConfiguredArtifactTx(tx, input, ts) {
+	await tx.insert(artifactFiles).values({
+		id: randomUUID(),
+		loopId: input.loopId,
+		path: input.path,
+		hash: input.hash,
+		size: input.size,
+		binary: input.binary,
+		oversize: input.oversize,
+		deleted: false,
+		updatedAt: ts
+	}).onConflictDoUpdate({
+		target: [artifactFiles.loopId, artifactFiles.path],
+		set: {
+			hash: input.hash,
+			size: input.size,
+			binary: input.binary,
+			oversize: input.oversize,
+			deleted: false,
+			updatedAt: ts
+		}
+	});
+}
+/** Upsert only while the exact literal path remains configured, serialized with
+* owner edits by the loop row lock. */
+async function upsertConfiguredArtifactFile(input) {
+	return db.transaction(async (tx) => {
+		const loop = (await tx.select({ artifacts: loops.artifacts }).from(loops).where(eq(loops.id, input.loopId)).for("update"))[0];
+		if (!loop || !loop.artifacts.includes(input.path)) return false;
+		await writeConfiguredArtifactTx(tx, input, nowIso$1());
+		return true;
+	});
+}
+/** Reconcile deletions against both the request's starting allowlist and the
+* current locked loop config. Newly-added paths are never tombstoned by an older
+* in-flight manifest; removed paths can never remain live. */
+async function reconcileConfiguredArtifacts(loopId, configuredAtStart, keepPaths) {
+	return db.transaction(async (tx) => {
+		const loop = (await tx.select({ artifacts: loops.artifacts }).from(loops).where(eq(loops.id, loopId)).for("update"))[0];
+		if (!loop) return 0;
+		const current = new Set(loop.artifacts);
+		const started = new Set(configuredAtStart);
+		const keep = new Set(keepPaths);
+		const stale = (await tx.select().from(artifactFiles).where(and(eq(artifactFiles.loopId, loopId), eq(artifactFiles.deleted, false)))).filter((file) => !current.has(file.path) || started.has(file.path) && !keep.has(file.path));
+		if (!stale.length) return 0;
+		const at = nowIso$1();
+		await tx.update(artifactFiles).set({
+			hash: null,
+			deleted: true,
+			updatedAt: at
+		}).where(inArray(artifactFiles.id, stale.map((file) => file.id)));
+		return stale.length;
+	});
+}
+async function listArtifacts(loopId) {
+	return db.select().from(artifactFiles).where(and(eq(artifactFiles.loopId, loopId), eq(artifactFiles.deleted, false))).orderBy(artifactFiles.path);
+}
+async function getArtifactFile(loopId, path) {
+	return (await db.select().from(artifactFiles).where(and(eq(artifactFiles.loopId, loopId), eq(artifactFiles.path, path))))[0];
+}
+async function buildLoopManifest(loopId) {
+	const manifest = {};
+	for (const f of await listArtifacts(loopId)) manifest[f.path] = {
+		hash: f.hash,
+		size: f.size,
+		binary: f.binary,
+		oversize: f.oversize
+	};
+	return manifest;
+}
+/** Write/overwrite a run's snapshot (path → file metadata). Idempotent on runId
+*  so a re-report of the same run just refreshes the captured artifact state. */
+async function putRunSnapshot(runId, loopId, manifest) {
+	await db.insert(runSnapshots).values({
+		runId,
+		loopId,
+		manifest,
+		createdAt: nowIso$1()
+	}).onConflictDoUpdate({
+		target: runSnapshots.runId,
+		set: {
+			loopId,
+			manifest,
+			createdAt: nowIso$1()
+		}
+	});
+}
+async function getRunSnapshot(runId) {
+	return (await db.select().from(runSnapshots).where(eq(runSnapshots.runId, runId)))[0];
+}
+/** The most recent indexed snapshot before one run. History order, not a
+* timestamp tie, is the diff baseline. */
+async function prevRunSnapshot(loopId, beforeRunIndex) {
+	return (await db.select({ snap: runSnapshots }).from(runSnapshots).innerJoin(runs, eq(runSnapshots.runId, runs.id)).where(and(eq(runSnapshots.loopId, loopId), isNotNull(runs.runIndex), lt(runs.runIndex, beforeRunIndex))).orderBy(desc(runs.runIndex)).limit(1))[0]?.snap;
+}
+/**
+* Prune a loop's run snapshots down to the `keep` most recent (by createdAt),
+* deleting the rest. Returns the number deleted. This is what makes an old
+* snapshot's now-unreferenced blobs collectable by the blob GC. `keep <= 0`
+* means "keep none" (still bounded). Safe to call repeatedly (idempotent once
+* at/under the window).
+*/
+async function pruneRunSnapshots(loopId, keep) {
+	const survivors = keep > 0 ? (await db.select({ runId: runSnapshots.runId }).from(runSnapshots).where(eq(runSnapshots.loopId, loopId)).orderBy(desc(runSnapshots.createdAt), desc(runSnapshots.runId)).limit(keep)).map((r) => r.runId) : [];
+	const pred = survivors.length ? and(eq(runSnapshots.loopId, loopId), notInArray(runSnapshots.runId, survivors)) : eq(runSnapshots.loopId, loopId);
+	return (await db.delete(runSnapshots).where(pred).returning({ id: runSnapshots.runId })).length;
+}
+async function loopIdsWithSnapshots() {
+	return (await db.selectDistinct({ loopId: runSnapshots.loopId }).from(runSnapshots)).map((r) => r.loopId);
+}
+/**
+* The full set of blob hashes still referenced by a LIVE row — the GC's keep
+* set. A hash is live if ANY artifact_files row points at it (deleted tombstones
+* carry hash=null, so they don't pin a blob) OR ANY retained run_snapshot's
+* manifest references it. Computed in one pass so the GC never deletes a blob a
+* snapshot still needs for its diff.
+*/
+async function liveBlobRefs() {
+	const refs = /* @__PURE__ */ new Set();
+	for (const r of await db.selectDistinct({ hash: artifactFiles.hash }).from(artifactFiles).where(isNotNull(artifactFiles.hash))) if (r.hash) refs.add(r.hash);
+	for (const hash of await collectSnapshotBlobRefs()) refs.add(hash);
+	return refs;
+}
+/** Blob hashes whose metadata row predates `cutoffIso` (GC candidates — the grace
+*  window excludes freshly-written blobs a concurrent sync may be referencing). */
+async function blobHashesOlderThan(cutoffIso) {
+	return (await db.select({ hash: blobs.hash }).from(blobs).where(lt(blobs.createdAt, cutoffIso))).map((r) => r.hash);
+}
+/** Delete a blob's metadata row (the bytes are reclaimed separately via the
+*  BlobStore). Idempotent. */
+async function deleteBlob(hash) {
+	await db.delete(blobs).where(eq(blobs.hash, hash));
+}
+/** Indexed point check: does any LIVE artifact_files row still point at this hash?
+*  The GC's cheap, always-fresh per-candidate guard (the common re-reference path) —
+*  uses the artifact_files_hash index, so it stays O(1) even as candidates pile up. */
+async function artifactFileReferencesHash(hash) {
+	return !!(await db.select({ id: artifactFiles.id }).from(artifactFiles).where(eq(artifactFiles.hash, hash)))[0];
+}
+/** Every blob hash referenced by ANY retained run_snapshot's manifest — the full
+*  snapshot scan deserialized ONCE into a Set so the GC can answer per-candidate
+*  snapshot membership in O(1) instead of re-scanning the whole table per garbage
+*  hash. The GC rebuilds this only when the snapshot row count changes (a report()
+*  raced the pass), so a snapshot that comes to reference a hash mid-pass is still
+*  caught — closing the GC-check-time gap where a snapshot references a hash no live
+*  file row does — without paying O(garbage × snapshots). */
+async function collectSnapshotBlobRefs() {
+	const refs = /* @__PURE__ */ new Set();
+	for (const r of await db.select({ manifest: runSnapshots.manifest }).from(runSnapshots)) for (const entry of Object.values(r.manifest)) if (entry?.hash) refs.add(entry.hash);
+	return refs;
+}
+async function snapshotBlobRefs() {
+	return collectSnapshotBlobRefs();
+}
+/** Count of retained run_snapshot rows — the GC's cheap change-detector for deciding
+*  whether to rebuild its precomputed snapshotBlobRefs() set mid-pass. */
+async function countRunSnapshots() {
+	const r = (await db.select({ n: sql`count(*)` }).from(runSnapshots))[0];
+	return Number(r?.n ?? 0);
+}
+var artifacts_exports = /* @__PURE__ */ __exportAll({
+	BLOB_CAP: () => BLOB_CAP,
+	SYNC_BODY_CAP: () => SYNC_BODY_CAP,
+	isValidHash: () => isValidHash,
+	parseArtifactSyncBody: () => parseArtifactSyncBody,
+	safeRelPath: () => safeRelPath,
+	sha256Buf: () => sha256Buf
+});
+/** Per-file byte cap. At or under ⇒ bytes sync; over ⇒ metadata-only (no bytes). */
+var BLOB_CAP = 10 * 1024 * 1024;
+/** Hard ceiling on the exact-manifest sync POST body. */
+var SYNC_BODY_CAP = 32 * 1024 * 1024;
+var SYNC_FIELDS = new Set(["loopId", "manifest"]);
+var MANIFEST_FIELDS = new Set([
+	"path",
+	"hash",
+	"size",
+	"binary",
+	"oversize"
+]);
+var MAX_STORED_SIZE = 2147483647;
+function exactRecord(value, fields) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	if (proto !== Object.prototype && proto !== null) return false;
+	const keys = Object.keys(value);
+	return keys.length === fields.size && keys.every((key) => fields.has(key));
+}
+function sha256Buf(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function isValidHash(hash) {
+	return typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash);
+}
+/**
+* Validate and preserve an untrusted, loop-folder-relative literal path. Returns
+* null if it is absolute, contains an empty/dot/traversal segment, is empty, or
+* carries a NUL (no real filesystem produces one, and Postgres rejects it).
+*/
+function safeRelPath(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.includes("\0")) return null;
+	if (raw.startsWith("/") || raw.startsWith("\\") || /^[A-Za-z]:[\\/]/.test(raw)) return null;
+	if (raw.split(/[\\/]/).some((part) => part === "" || part === "." || part === "..")) return null;
+	return raw;
+}
+/** Parse the one canonical sync envelope without coercion or omitted-field defaults. */
+function parseArtifactSyncBody(value) {
+	if (!exactRecord(value, SYNC_FIELDS)) return null;
+	const { loopId, manifest } = value;
+	if (typeof loopId !== "string" || loopId.length === 0 || loopId.length > 200 || loopId.includes("\0") || !Array.isArray(manifest)) return null;
+	const entries = [];
+	const paths = /* @__PURE__ */ new Set();
+	for (const raw of manifest) {
+		if (!exactRecord(raw, MANIFEST_FIELDS)) return null;
+		const { path, hash, size, binary, oversize } = raw;
+		const rel = safeRelPath(path);
+		if (rel === null || paths.has(rel) || typeof size !== "number" || !Number.isSafeInteger(size) || size < 0 || size > MAX_STORED_SIZE || typeof binary !== "boolean" || typeof oversize !== "boolean") return null;
+		if (oversize) {
+			if (size <= 10485760 || hash !== null) return null;
+			entries.push({
+				path: rel,
+				hash: null,
+				size,
+				binary,
+				oversize: true
+			});
+		} else {
+			if (size > 10485760 || !isValidHash(hash)) return null;
+			entries.push({
+				path: rel,
+				hash,
+				size,
+				binary,
+				oversize: false
+			});
+		}
+		paths.add(rel);
+	}
+	return {
+		loopId,
+		manifest: entries
+	};
+}
+/**
+* Machine + run credential helpers. Device tokens (`dk_…`) identify a machine
+* (its id is derived from the token: `m-sha256(token)[:16]`). A run
+* LEASE (`rk_…`) is minted per delivery, bound to one run, and carries the
+* run's least-privilege caps — the CLI dispatch authorizes the `pievo` shim
+* against it. Its lifecycle is a small state machine (`active` →
+* `terminal-grace` → `reconciliation-only`/`retired`), not a mint→revoke pair;
+* see `RunLease` below.
+*
+* Leases and connect-key bindings are DURABLE (run_leases / connect_keys
+* tables): they must survive a deploy, or every restart 401s the in-flight
+* runs' callbacks/finalize and prevents a freshly connected machine from
+* enrolling. The 15-minute `new` idempotency window stays in-process;
+* losing it only degrades retry deduplication, never persisted data.
+*/
+var tokens_exports = /* @__PURE__ */ __exportAll({
+	CONNECT_KEY_TTL_MS: () => CONNECT_KEY_TTL_MS,
+	NEW_IDEMPOTENCY_TTL_MS: () => NEW_IDEMPOTENCY_TTL_MS,
+	TERMINAL_GRACE_MS: () => TERMINAL_GRACE_MS,
+	connectKeyValid: () => connectKeyValid,
+	isDeviceTokenShape: () => isDeviceTokenShape,
+	isRunTokenShape: () => isRunTokenShape,
+	machineIdFromToken: () => machineIdFromToken,
+	mintDeviceToken: () => mintDeviceToken,
+	pruneExpiredLeases: () => pruneExpiredLeases,
+	readNewIdempotency: () => readNewIdempotency,
+	recordNewIdempotency: () => recordNewIdempotency,
+	rememberConnectKey: () => rememberConnectKey,
+	resolveLease: () => resolveLease,
+	retireLease: () => retireLease,
+	sha256: () => sha256
+});
+function sha256(s) {
+	return createHash("sha256").update(s).digest("hex");
+}
+function mintDeviceToken() {
+	return `dk_${randomBytes(15).toString("hex")}`;
+}
+function machineIdFromToken(token) {
+	return `m-${sha256(token).slice(0, 16)}`;
+}
+/**
+* Whether a string has the one current device-token wire shape. This malformed-input
+* filter runs before enrollment lookup; the connect-key gate remains the auth boundary.
+*/
+var DEVICE_TOKEN_RE = /^dk_[0-9a-f]{30}$/;
+function isDeviceTokenShape(token) {
+	return DEVICE_TOKEN_RE.test(token);
+}
+/** Keep bindings long enough for a leisurely paste, then drop (bounded table). */
+var CONNECT_KEY_TTL_MS = 1440 * 60 * 1e3;
+function connectKeyFresh(mintedAt, now) {
+	return now - Date.parse(mintedAt) <= CONNECT_KEY_TTL_MS;
+}
+/** Record a freshly minted connect key and prune expired rows. */
+async function rememberConnectKey(connectKey) {
+	const now = /* @__PURE__ */ new Date();
+	await db.delete(connectKeys).where(lt(connectKeys.mintedAt, (/* @__PURE__ */ new Date(now.getTime() - CONNECT_KEY_TTL_MS)).toISOString()));
+	const row = {
+		machineId: machineIdFromToken(connectKey),
+		mintedAt: now.toISOString()
+	};
+	await db.insert(connectKeys).values(row).onConflictDoUpdate({
+		target: connectKeys.machineId,
+		set: row
+	});
+}
+async function connectKeyValid(connectKey, now = Date.now()) {
+	if (!connectKey) return false;
+	const row = (await db.select().from(connectKeys).where(eq(connectKeys.machineId, machineIdFromToken(connectKey))))[0];
+	return !!row && connectKeyFresh(row.mintedAt, now);
+}
+/** How long a terminal-grace lease stays alive to accept one late wake-report.
+*  A laptop can sleep overnight or across a weekend before the daemon resumes. */
+var TERMINAL_GRACE_MS = 1440 * 60 * 1e3;
+/** Leases live in the `run_leases` table, keyed by sha256(full `rk_…` wire
+* token), so a deploy is invisible to an in-flight run and a DB leak never hands
+* out live credentials. In rows, `expiresAt` null encodes `Infinity`. */
+function leaseFromRow(row) {
+	return {
+		runId: row.runId,
+		loopId: row.loopId,
+		machineId: row.machineId,
+		state: row.state,
+		expiresAt: row.expiresAt == null ? Number.POSITIVE_INFINITY : Date.parse(row.expiresAt)
+	};
+}
+/** Mint a fresh run lease and return its wire token (`rk_…`, so the unified CLI
+*  dispatch can tell a run credential from a device `dk_…` in O(1) before any
+*  lookup). Starts `active` with no expiry. */
+var RUN_TOKEN_RE = /^rk_[0-9a-f]{32}$/;
+function isRunTokenShape(token) {
+	return RUN_TOKEN_RE.test(token);
+}
+/** Resolve a run lease. An elapsed reconciliation window is atomically reduced
+* to durable, non-authorizing retired evidence rather than deleted. */
+async function resolveLease(token, now = Date.now()) {
+	if (!isRunTokenShape(token)) return void 0;
+	const tokenHash = sha256(token);
+	let row = (await db.select().from(runLeases).where(eq(runLeases.tokenHash, tokenHash)))[0];
+	if (!row) return void 0;
+	if ((row.state === "terminal-grace" || row.state === "reconciliation-only") && row.expiresAt != null && now > Date.parse(row.expiresAt)) {
+		row = (await db.update(runLeases).set({
+			state: "retired",
+			expiresAt: null
+		}).where(and(eq(runLeases.tokenHash, tokenHash), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), isNotNull(runLeases.expiresAt), lt(runLeases.expiresAt, new Date(now).toISOString()))).returning())[0] ?? (await db.select().from(runLeases).where(eq(runLeases.tokenHash, tokenHash)))[0];
+		if (!row) return void 0;
+	}
+	return leaseFromRow(row);
+}
+/** Retire a lease outside a terminal write transaction (canceled/losing report
+* cleanup and expiry paths). Normal finalize and reclaimed-run
+* reconcile consume the row inside their store transaction so run+loop+lease are
+* one single-shot commit. */
+async function retireLease(token) {
+	await db.delete(runLeases).where(eq(runLeases.tokenHash, sha256(token)));
+}
+/** State-aware lease maintenance. Expired reconciliation authority becomes a
+* durable retired tombstone. Active and already-retired rows are never age-pruned. */
+async function pruneExpiredLeases(now = Date.now()) {
+	await db.update(runLeases).set({
+		state: "retired",
+		expiresAt: null
+	}).where(and(inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), isNotNull(runLeases.expiresAt), lt(runLeases.expiresAt, new Date(now).toISOString())));
+}
+var newIdempotency = /* @__PURE__ */ new Map();
+/** Long enough to swallow a timed-out retry without collapsing later creates. */
+var NEW_IDEMPOTENCY_TTL_MS = 900 * 1e3;
+function pruneNewIdempotency(now) {
+	for (const [key, rec] of newIdempotency) if (now - rec.at > 9e5) newIdempotency.delete(key);
+}
+function recordNewIdempotency(key, machineId, loopId, now = Date.now()) {
+	pruneNewIdempotency(now);
+	newIdempotency.set(key, {
+		loopId,
+		machineId,
+		at: now
+	});
+}
+/** The loop a still-live key already created for THIS machine, or undefined (a miss,
+*  an expired key — dropped here — or a cross-machine record). NON-evicting on a hit:
+*  a genuine retry may arrive more than once within the window. */
+function readNewIdempotency(key, machineId, now = Date.now()) {
+	const rec = newIdempotency.get(key);
+	if (!rec) return void 0;
+	if (now - rec.at > 9e5) {
+		newIdempotency.delete(key);
+		return;
+	}
+	if (rec.machineId !== machineId) return void 0;
+	return rec.loopId;
+}
+/**
+* Derive a machine's presence from its stored `online` flag + `lastSeen` stamp.
+* `online` requires BOTH the flag and a fresh stamp (the stored flag lags the
+* sweep by up to one interval); everything else keys off how stale `lastSeen` is.
+*/
+function machinePresence(online, lastSeen, now = Date.now()) {
+	const seenAt = lastSeen ? Date.parse(lastSeen) : NaN;
+	if (!Number.isFinite(seenAt)) return "offline";
+	const age = now - seenAt;
+	if (!!online && age < 3e4) return "online";
+	if (age < 216e5) return "asleep";
+	return "offline";
+}
+/**
+* Tiny semver comparison — just enough to decide "is the daemon older than the
+* latest published version?" for the web's update hint. No dependency; we only
+* need numeric-core ordering (major.minor.patch), and a pre-release is treated
+* as older than its release (a "0.9.0-rc.1" daemon is still behind "0.9.0").
+*/
+/** Strict SemVer validation for security/protocol gates. Unlike the update-hint
+* comparison below, this accepts no whitespace, `v` prefix, partial core, or
+* trailing garbage. */
+function isValidSemver(value) {
+	const plus = value.split("+");
+	if (plus.length > 2) return false;
+	const [versionAndPre, build] = plus;
+	if (build !== void 0 && !validIdentifiers(build, false)) return false;
+	const dash = versionAndPre.indexOf("-");
+	const numeric = dash < 0 ? versionAndPre : versionAndPre.slice(0, dash);
+	const pre = dash < 0 ? void 0 : versionAndPre.slice(dash + 1);
+	if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(numeric)) return false;
+	return pre === void 0 || validIdentifiers(pre, true);
+}
+function validIdentifiers(value, rejectNumericLeadingZero) {
+	if (!value) return false;
+	return value.split(".").every((identifier) => {
+		if (!/^[0-9A-Za-z-]+$/.test(identifier)) return false;
+		return !rejectNumericLeadingZero || !/^\d+$/.test(identifier) || identifier === "0" || !identifier.startsWith("0");
+	});
+}
+function core(v) {
+	const m = /^\s*v?(\d+)\.(\d+)\.(\d+)/.exec(v);
+	if (!m) return null;
+	return [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	];
+}
+function isPre(v) {
+	return /^\s*v?\d+\.\d+\.\d+-/.test(v);
+}
+/**
+* `true` when `current` is strictly older than `latest`. Returns `false` on any
+* unparseable/equal/newer input — the hint is opt-in, so we only ever show it
+* when we can be confident the daemon is genuinely behind.
+*/
+function isOutdated(current, latest) {
+	if (!current || !latest) return false;
+	const a = core(current);
+	const b = core(latest);
+	if (!a || !b) return false;
+	for (let i = 0; i < 3; i++) {
+		const ai = a[i];
+		const bi = b[i];
+		if (ai < bi) return true;
+		if (ai > bi) return false;
+	}
+	return isPre(current) && !isPre(latest);
+}
+var reserved = new Set(RESERVED_LOOP_TAGS);
+function normalizeLoopTag(value) {
+	return value.normalize("NFKC").trim().replace(/\s+/gu, " ").toLocaleLowerCase("en-US");
+}
+function validateLoopTags(value) {
+	if (value === void 0) return {
+		ok: true,
+		value: []
+	};
+	if (!Array.isArray(value)) return {
+		ok: false,
+		detail: "tags must be an array of strings"
+	};
+	if (value.length > 4) return {
+		ok: false,
+		detail: `tags must contain at most 4 values`
+	};
+	const tags = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (typeof entry !== "string") return {
+			ok: false,
+			detail: "tags must contain only strings"
+		};
+		if (/\p{Cc}|\p{Cf}|\p{Default_Ignorable_Code_Point}/u.test(entry)) return {
+			ok: false,
+			detail: "tags must not contain control or invisible characters"
+		};
+		const tag = normalizeLoopTag(entry);
+		if (!tag) return {
+			ok: false,
+			detail: "tags must not contain empty values"
+		};
+		if ([...tag].length > 64) return {
+			ok: false,
+			detail: `each tag must contain at most 64 characters`
+		};
+		if (reserved.has(tag)) return {
+			ok: false,
+			detail: `reserved tag: ${tag}`
+		};
+		if (seen.has(tag)) return {
+			ok: false,
+			detail: `duplicate tag: ${tag}`
+		};
+		seen.add(tag);
+		tags.push(tag);
+	}
+	return {
+		ok: true,
+		value: [...tags].sort()
+	};
+}
+//#endregion
+//#region node_modules/.nitro/vite/services/ssr/assets/boot-CYRi-wez.js
+var boot_CYRi_wez_exports = /* @__PURE__ */ __exportAll$1({
 	_: () => validOptionalPollString,
 	a: () => POLL_HTTP_BODY_FIELDS,
 	c: () => MIN_DAEMON_VERSION,
-	d: () => statusDefinitionsFromLoop,
+	d: () => canonicalLoopSummary,
 	f: () => validateLoopEdit,
 	g: () => readJsonBody,
 	h: () => readByteBody,
 	i: () => runDiff_exports,
 	l: () => daemonNeedsUpdate,
-	m: () => POLL_INFO_TEXT_CAP,
+	m: () => WIRE_TEXT_CAP,
 	n: () => ensureServer,
 	o: () => validPollCurrentRun,
 	p: () => MACHINE_BODY_CAP,
 	r: () => getArtifactSync,
 	s: () => validPollWireId,
 	t: () => boot_exports,
-	u: () => scheduleFromLoop
+	u: () => canonicalLoopEnvelope
 });
 /**
 * Machine-route ingress: read + parse a JSON request body under a hard size cap.
@@ -116,7 +2176,7 @@ function nowIso() {
 /** Strip NUL (U+0000) from a wire string: Postgres text/jsonb columns REJECT the
 *  NUL byte (SQLite tolerated it), so a daemon-supplied string carrying one would
 *  throw mid-finalize on the DB write. The single sanitizing primitive behind
-*  `clipText` and index.ts's `str` - and used directly by `cli.ts`
+*  `clipText` - and used directly by `cli.ts`
 *  (parseFlags/validateState, the same one-chokepoint discipline). */
 function stripNul(s) {
 	return s.replace(/\u0000/g, "");
@@ -157,13 +2217,8 @@ async function buildDelivery(loop, queuedRun, runToken, roots) {
 * loop/run). The store ONLY writes/reads bytes — it never executes or interprets
 * them — preserving the server's zero-exec invariant.
 *
-* Three implementations behind one small interface:
-*   • LocalBlobStore — durable filesystem default under PIEVO_DATA_DIR/blobs.
-*   • R2BlobStore — Cloudflare R2 (S3-compatible) when credentials are configured.
-*   • MemoryBlobStore — explicit ephemeral selection or injected test fake.
-*
-* The S3 client is dynamic-imported inside R2BlobStore so tests (and any deploy
-* without R2 creds) never load the AWS SDK, and it stays out of the client bundle.
+* `LocalBlobStore` is the durable store under `<dataDir>/blobs`;
+* `MemoryBlobStore` is the injected test fake.
 */
 var log$4 = logger.child({ mod: "blobstore" });
 var SHA256_HEX = /^[a-f0-9]{64}$/;
@@ -277,132 +2332,15 @@ var LocalBlobStore = class {
 		await this.syncDir(path.dirname(target));
 	}
 };
-var MemoryBlobStore = class {
-	map = /* @__PURE__ */ new Map();
-	async has(hash) {
-		return this.map.has(hash);
-	}
-	async put(hash, bytes) {
-		this.map.set(hash, Buffer.from(bytes));
-	}
-	async get(hash) {
-		return this.map.get(hash) ?? null;
-	}
-	async delete(hash) {
-		this.map.delete(hash);
-	}
-};
-function blobKey(hash) {
-	return `blobs/${hash}`;
-}
-var R2BlobStore = class {
-	cfg;
-	client;
-	constructor(cfg) {
-		this.cfg = cfg;
-	}
-	async s3() {
-		if (this.client) return this.client;
-		const { S3Client } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		this.client = new S3Client({
-			region: this.cfg.region,
-			endpoint: this.cfg.endpoint,
-			credentials: {
-				accessKeyId: this.cfg.accessKeyId,
-				secretAccessKey: this.cfg.secretAccessKey
-			},
-			forcePathStyle: true
-		});
-		return this.client;
-	}
-	async has(hash) {
-		const { HeadObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		const client = await this.s3();
-		try {
-			await client.send(new HeadObjectCommand({
-				Bucket: this.cfg.bucket,
-				Key: blobKey(hash)
-			}));
-			return true;
-		} catch (err) {
-			if (isNotFound(err)) return false;
-			throw err;
-		}
-	}
-	async put(hash, bytes) {
-		const { PutObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		await (await this.s3()).send(new PutObjectCommand({
-			Bucket: this.cfg.bucket,
-			Key: blobKey(hash),
-			Body: bytes,
-			ContentLength: bytes.length
-		}));
-	}
-	async get(hash) {
-		const { GetObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		const client = await this.s3();
-		try {
-			const body = (await client.send(new GetObjectCommand({
-				Bucket: this.cfg.bucket,
-				Key: blobKey(hash)
-			}))).Body;
-			if (!body?.transformToByteArray) return null;
-			return Buffer.from(await body.transformToByteArray());
-		} catch (err) {
-			if (isNotFound(err)) return null;
-			throw err;
-		}
-	}
-	async delete(hash) {
-		const { DeleteObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
-		await (await this.s3()).send(new DeleteObjectCommand({
-			Bucket: this.cfg.bucket,
-			Key: blobKey(hash)
-		}));
-	}
-};
-function isNotFound(err) {
-	const e = err;
-	return e?.name === "NotFound" || e?.name === "NoSuchKey" || e?.$metadata?.httpStatusCode === 404;
-}
-/**
-* The configured blob store: durable local filesystem under PIEVO_DATA_DIR by
-* default; complete R2 credentials preserve the existing R2 selection behavior,
-* while memory requires an explicit selector. Constructed once and shared by every
-* gateway so writes, reads, and GC use the same adapter.
-*/
+/** The one local blob store shared by sync writes, artifact reads, and GC. */
 function createBlobStore() {
-	const selection = process.env.PIEVO_BLOB_STORE?.trim().toLowerCase();
-	if (selection && ![
-		"local",
-		"r2",
-		"memory"
-	].includes(selection)) throw new Error("PIEVO_BLOB_STORE must be local, r2, or memory");
-	if (selection === "memory") {
-		log$4.warn("blob store: EPHEMERAL MEMORY explicitly selected; all artifact bytes are lost on restart");
-		return new MemoryBlobStore();
-	}
-	if (selection === "local") {
-		const local = new LocalBlobStore();
-		log$4.info({ root: local.root }, "blob store: local filesystem (explicit)");
-		return local;
-	}
-	const cfg = r2Config();
-	if (selection === "r2" && !cfg) throw new Error("PIEVO_BLOB_STORE=r2 requires complete PIEVO_R2_* configuration");
-	if (cfg) {
-		log$4.info({
-			bucket: cfg.bucket,
-			endpoint: cfg.endpoint
-		}, "blob store: Cloudflare R2");
-		return new R2BlobStore(cfg);
-	}
 	const local = new LocalBlobStore();
 	log$4.info({ root: local.root }, "blob store: local filesystem");
 	return local;
 }
 /**
 * Artifact-storage retention + garbage collection — the policy that keeps the
-* local/R2 byte store from growing monotonically.
+* local byte store from growing monotonically.
 *
 * The artifact pipeline is content-addressed: blob BYTES are keyed by sha256 and
 * deduped across every loop/run. When a path is deleted or its content changes,
@@ -433,7 +2371,7 @@ var log$3 = logger.child({ mod: "retention" });
 * (most-recent-N). Returns the total number pruned. This is what makes an old
 * snapshot's now-unreferenced blobs collectable by gcBlobs().
 */
-async function pruneSnapshots(keep = snapshotRetention()) {
+async function pruneSnapshots(keep = 20) {
 	let pruned = 0;
 	for (const loopId of await loopIdsWithSnapshots()) pruned += await pruneRunSnapshots(loopId, keep);
 	return pruned;
@@ -462,7 +2400,7 @@ async function pruneSnapshots(keep = snapshotRetention()) {
 *         so that file re-uploads its bytes on the next sync. We never leave a
 *         live blobs row pointing at deleted bytes.
 */
-async function gcBlobs(blobStore, graceMs = blobGcGraceMs()) {
+async function gcBlobs(blobStore, graceMs = BLOB_GC_GRACE_MS) {
 	const refs = await liveBlobRefs();
 	const garbage = (await blobHashesOlderThan(new Date(Date.now() - graceMs).toISOString())).filter((h) => !refs.has(h));
 	let snapCount = await countRunSnapshots();
@@ -488,15 +2426,9 @@ async function gcBlobs(blobStore, graceMs = blobGcGraceMs()) {
 	}
 	return reclaimed;
 }
-/**
-* One full storage-maintenance pass: prune snapshots, then GC the blobs they
-* freed (plus any already-unreferenced). Order matters — pruning first lets the
-* same pass reclaim the blobs it just unpinned. Idempotent and safe with no
-* garbage (returns zeros).
-*/
-async function maintainStorage(blobStore) {
-	const snapshotsPruned = await pruneSnapshots();
-	const blobsReclaimed = await gcBlobs(blobStore);
+async function maintainStorage(blobStore, options = {}) {
+	const snapshotsPruned = await pruneSnapshots(options.keep);
+	const blobsReclaimed = await gcBlobs(blobStore, options.graceMs);
 	if (snapshotsPruned || blobsReclaimed) log$3.info({
 		snapshotsPruned,
 		blobsReclaimed
@@ -911,6 +2843,15 @@ function statusDefinitionsFromLoop(loop) {
 	};
 }
 function canonicalLoopEnvelope(loop) {
+	return {
+		...canonicalLoopSummary(loop),
+		prompt: loop.prompt,
+		statusDefinitions: statusDefinitionsFromLoop(loop),
+		artifacts: loop.artifacts,
+		enabled: loop.enabled
+	};
+}
+function canonicalLoopSummary(loop) {
 	return {
 		id: loop.id,
 		name: loop.name,
@@ -919,11 +2860,7 @@ function canonicalLoopEnvelope(loop) {
 		workdir: loop.workdir,
 		agent: loop.agent,
 		model: loop.model ?? null,
-		reasoningEffort: loop.reasoningEffort ?? null,
-		prompt: loop.prompt,
-		statusDefinitions: statusDefinitionsFromLoop(loop),
-		artifacts: loop.artifacts,
-		enabled: loop.enabled
+		reasoningEffort: loop.reasoningEffort ?? null
 	};
 }
 function validateLoopCreate(value) {
@@ -1140,7 +3077,7 @@ var configuredRunTimeoutMs = Number(process.env.PIEVO_RUN_TIMEOUT_MS || 20 * 6e4
 var RUN_TIMEOUT_MS = Number.isFinite(configuredRunTimeoutMs) && configuredRunTimeoutMs > 0 ? configuredRunTimeoutMs : 20 * 6e4;
 /** The ONLY keys an owner `editLoop` patch may touch. A key outside this set is
 *  rejected (400) rather than silently ignored, so a `--json` typo fails loudly
-*  and identity/ownership columns (id/userId/machineId/timestamps) can never be
+*  and identity columns (id/machineId/timestamps) can never be
 *  patched over the device-token edit surface. Exported for `cli.ts`
 *  (the `new`/`edit` verb help lists these keys). */
 var EDITABLE_LOOP_FIELDS = LOOP_EDIT_FIELDS;
@@ -1438,7 +3375,7 @@ var MachineGateway = class {
 	* grace window + final re-check protect freshly-written/referenced blobs) and
 	* idempotent with no garbage. Best-effort — never throws into the caller.
 	*/
-	async maintainStorage() {
+	async maintainStorage(options) {
 		if (this.maintenanceRunning) {
 			log$2.info("storage maintenance already in progress — skipping this tick");
 			return {
@@ -1448,7 +3385,7 @@ var MachineGateway = class {
 		}
 		this.maintenanceRunning = true;
 		try {
-			return await maintainStorage(this.blobStore);
+			return await maintainStorage(this.blobStore, options);
 		} catch (err) {
 			log$2.warn({ err: err instanceof Error ? err.message : String(err) }, "storage maintenance failed");
 			return {
@@ -1465,14 +3402,12 @@ var MachineGateway = class {
 		const { machineId } = auth;
 		let machine = auth.machine;
 		if (!machine) {
-			const binding = await readConnectKeyBinding(deviceToken);
-			if (!binding) return {
+			if (!await connectKeyValid(deviceToken)) return {
 				status: 401,
 				body: { error: "unknown device token — connect this machine first" }
 			};
 			machine = await createMachine({
 				id: machineId,
-				userId: binding.userId,
 				name: info?.host || `machine-${machineId.slice(2, 8)}`,
 				tokenHash: sha256(deviceToken),
 				token: deviceToken,
@@ -1620,7 +3555,7 @@ var MachineGateway = class {
 			status: 200,
 			body: {
 				registered: false,
-				claimValid: await readConnectKeyBinding(deviceToken) !== void 0,
+				claimValid: await connectKeyValid(deviceToken),
 				online: false,
 				name: null,
 				lastSeen: null,
@@ -1650,7 +3585,6 @@ var MachineGateway = class {
 		const auth = await authenticateDeviceToken(deviceToken);
 		if (!auth.ok) return auth.response;
 		const { machineId } = auth;
-		const machine = auth.machine;
 		{
 			if (body === null || typeof body !== "object" || Array.isArray(body)) return {
 				status: 400,
@@ -1693,7 +3627,6 @@ var MachineGateway = class {
 				}
 			};
 			const loop = await createLoop({
-				userId: machine.userId,
 				machineId,
 				...row
 			});
@@ -1916,6 +3849,51 @@ var MachineGateway = class {
 		log$2.info({ runId: lease.runId }, "report: ignored (run was canceled)");
 		return response;
 	}
+	async reportRaceResponse(runToken, lease, body, payloadDigest) {
+		const raced = await committedReportEvidence(body.reportId, payloadDigest, lease.runId);
+		if (raced.response) return raced.response;
+		if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+	}
+	async resolveLostTerminalRace(runToken, lease, body, payloadDigest, retryReconcile, logMessage) {
+		const raced = await this.reportRaceResponse(runToken, lease, body, payloadDigest);
+		if (raced) return raced;
+		const fresh = await getRun(lease.runId);
+		if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
+		if (fresh?.phase === "done") return {
+			status: 409,
+			body: {
+				error: "run already finalized",
+				code: "REPORT_NOT_FINALIZED",
+				reportId: body.reportId
+			}
+		};
+		const refreshedLease = await resolveLease(runToken);
+		if (refreshedLease?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
+		if (retryReconcile && fresh?.phase === "error" && refreshedLease?.state === "terminal-grace") return this.reconcileReclaimedReport(runToken, refreshedLease, fresh, body);
+		log$2.info({
+			runId: lease.runId,
+			phase: fresh?.phase
+		}, logMessage);
+		return {
+			status: 409,
+			body: {
+				error: "terminal report was not finalized",
+				code: "REPORT_NOT_FINALIZED",
+				reportId: body.reportId
+			}
+		};
+	}
+	async captureRunSnapshot(runId, loopId) {
+		try {
+			await putRunSnapshot(runId, loopId, await buildLoopManifest(loopId));
+			await pruneRunSnapshots(loopId, 20);
+		} catch (err) {
+			log$2.warn({
+				runId,
+				err: err instanceof Error ? err.message : String(err)
+			}, "snapshot capture failed");
+		}
+	}
 	/** Reconcile one swept run. The store consumes the terminal-grace lease in the
 	* same loop-lock transaction as the error→done/error patch and loop state, so
 	* concurrent late reports cannot both win (including error→error). */
@@ -1938,51 +3916,14 @@ var MachineGateway = class {
 				ts: nowIso()
 			}, loopPatch, AUTOPAUSE_STREAK, receipt);
 		} catch (error) {
-			const raced = await committedReportEvidence(receipt.reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			const raced = await this.reportRaceResponse(runToken, lease, body, payloadDigest);
+			if (raced) return raced;
 			throw error;
 		}
-		if (!reconciled) {
-			const raced = await committedReportEvidence(receipt.reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
-			const fresh = await getRun(lease.runId);
-			if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
-			if (fresh?.phase === "done") return {
-				status: 409,
-				body: {
-					error: "run already finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId: body.reportId
-				}
-			};
-			if ((await resolveLease(runToken))?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
-			log$2.info({
-				runId: lease.runId,
-				phase: fresh?.phase
-			}, "report: late reconcile lost terminal race");
-			return {
-				status: 409,
-				body: {
-					error: "terminal report was not finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId: body.reportId
-				}
-			};
-		}
+		if (!reconciled) return this.resolveLostTerminalRace(runToken, lease, body, payloadDigest, false, "report: late reconcile lost terminal race");
 		const deleting = reconciled.loop.deleteRequestedAt != null;
 		const reportOnly = reconciled.reportOnly === true;
-		if (!deleting && !reportOnly) try {
-			await putRunSnapshot(lease.runId, lease.loopId, await buildLoopManifest(lease.loopId));
-			await pruneRunSnapshots(lease.loopId, snapshotRetention());
-		} catch (err) {
-			log$2.warn({
-				runId: lease.runId,
-				err: err instanceof Error ? err.message : String(err)
-			}, "snapshot capture failed");
-		}
-		reconciled.run;
+		if (!deleting && !reportOnly) await this.captureRunSnapshot(lease.runId, lease.loopId);
 		if (!reportOnly) this.scheduler.addLoop(reconciled.loop);
 		if (!reportOnly) this.applyAutopauseTimer(lease.loopId, reconciled);
 		if (deleting) await tryDeleteLoop(lease.loopId);
@@ -2118,52 +4059,13 @@ var MachineGateway = class {
 				ts: nowIso()
 			}, loopPatch, sha256(runToken), AUTOPAUSE_STREAK, expected);
 		} catch (error) {
-			const raced = await committedReportEvidence(reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			const raced = await this.reportRaceResponse(runToken, lease, body, payloadDigest);
+			if (raced) return raced;
 			throw error;
 		}
-		if (!terminal) {
-			const raced = await committedReportEvidence(reportId, payloadDigest, lease.runId);
-			if (raced.response) return raced.response;
-			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
-			const fresh = await getRun(lease.runId);
-			if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
-			if (fresh?.phase === "done") return {
-				status: 409,
-				body: {
-					error: "run already finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId
-				}
-			};
-			const refreshedLease = await resolveLease(runToken);
-			if (refreshedLease?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
-			if (fresh?.phase === "error" && refreshedLease?.state === "terminal-grace") return this.reconcileReclaimedReport(runToken, refreshedLease, fresh, body);
-			log$2.info({
-				runId: lease.runId,
-				phase: fresh?.phase
-			}, "report: lost terminal race");
-			return {
-				status: 409,
-				body: {
-					error: "terminal report was not finalized",
-					code: "REPORT_NOT_FINALIZED",
-					reportId
-				}
-			};
-		}
-		terminal.run;
+		if (!terminal) return this.resolveLostTerminalRace(runToken, lease, body, payloadDigest, true, "report: lost terminal race");
 		const deleting = terminal.loop.deleteRequestedAt != null;
-		if (!deleting) try {
-			await putRunSnapshot(lease.runId, lease.loopId, await buildLoopManifest(lease.loopId));
-			await pruneRunSnapshots(lease.loopId, snapshotRetention());
-		} catch (err) {
-			log$2.warn({
-				runId: lease.runId,
-				err: err instanceof Error ? err.message : String(err)
-			}, "snapshot capture failed");
-		}
+		if (!deleting) await this.captureRunSnapshot(lease.runId, lease.loopId);
 		this.scheduler.addLoop(terminal.loop);
 		this.applyAutopauseTimer(lease.loopId, terminal);
 		log$2.info({
@@ -2435,7 +4337,7 @@ var ArtifactSync = class {
 * process execution, so the server's zero-exec invariant holds. Binary/oversize
 * files emit a size-delta marker only (no inline diff).
 */
-var runDiff_exports = /* @__PURE__ */ __exportAll$1({ computeRunDiff: () => computeRunDiff });
+var runDiff_exports = /* @__PURE__ */ __exportAll({ computeRunDiff: () => computeRunDiff });
 /**
 * Upper bound for computing an inline unified diff. jsdiff is synchronous and
 * roughly O(N*D); on a multi-MB or minified text file it would block the
@@ -3152,7 +5054,6 @@ var CliGateway = class {
 				action: "force-delete",
 				loopId: loop.id,
 				machineId,
-				actorUserId: loop.userId,
 				machineReachability: reachability
 			});
 			return {
@@ -3777,87 +5678,6 @@ function msg(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 /**
-* DB watchdog — the real auto-recovery backstop for a wedged postgres-js pool.
-*
-* BACKGROUND (2026-07-12 outage, twice in one day): the runtime pool against the
-* Supabase transaction pooler wedged — every connection stuck on a query that
-* never returned, so `/api/health/db`'s `select 1` queued behind them forever and
-* the server stopped sending response headers. Fly's health check went `critical`,
-* which only PULLS the machine from load balancing (a well-known Fly footgun:
-* failing `[http_service.checks]` do NOT restart the VM — only a process EXIT
-* triggers `restart.policy = "on-failure"`). Result: ~9h fully down with no
-* auto-recovery until a manual `fly machine restart`. The pool's own self-healing
-* (`max_lifetime`/`statement_timeout`, `db/index.ts`) can't cover a busy-wedged
-* connection or a dead socket that never errors.
-*
-* This watchdog closes that gap: it pings `select 1` on a fixed cadence under a
-* HARD client-side deadline (a hung ping counts as a failure, since the underlying
-* query can't be canceled). After N consecutive failures it exits the process, so
-* Fly restarts the machine with a fresh pool — turning a multi-hour hang into a
-* ~1-2min self-heal. A single healthy ping resets the streak, so a transient blip
-* never restarts the box.
-*
-* Pure + injectable: `makeDbWatchdog` takes the probe / exit / clock as deps so the
-* decision logic is unit-tested with no real DB, timers, or `process.exit`.
-*/
-/** Reject if `p` hasn't settled within `ms`. The underlying promise keeps running
-*  (we can't cancel a wedged query) — bounded by the exit after `failureThreshold`. */
-function withDeadline(p, ms, setTimer, clearTimer) {
-	return new Promise((resolve, reject) => {
-		const h = setTimer(() => reject(/* @__PURE__ */ new Error(`db ping timed out after ${ms}ms`)), ms);
-		p.then((v) => {
-			clearTimer(h);
-			resolve(v);
-		}, (e) => {
-			clearTimer(h);
-			reject(e instanceof Error ? e : new Error(String(e)));
-		});
-	});
-}
-function makeDbWatchdog(deps) {
-	const { probe, exit, timeoutMs, failureThreshold, setTimer = (fn, ms) => setTimeout(fn, ms), clearTimer = (h) => clearTimeout(h), log = logger } = deps;
-	let consecutive = 0;
-	let running = false;
-	let done = false;
-	async function tick() {
-		if (running || done) return;
-		running = true;
-		try {
-			await withDeadline(Promise.resolve().then(probe), timeoutMs, setTimer, clearTimer);
-			consecutive = 0;
-		} catch (err) {
-			consecutive += 1;
-			log.warn({
-				consecutive,
-				failureThreshold,
-				err: String(err)
-			}, "db watchdog: liveness ping failed");
-			if (consecutive >= failureThreshold) {
-				done = true;
-				log.error({ consecutive }, "db watchdog: database unreachable for too long — exiting so the platform restarts with a fresh pool");
-				exit(1);
-			}
-		} finally {
-			running = false;
-		}
-	}
-	return {
-		tick,
-		failures: () => consecutive
-	};
-}
-/**
-* Start the watchdog on a repeating interval. Returns a stop function (cleared on
-* the boot AbortController). The interval is `unref`'d so it never keeps the
-* process alive on its own.
-*/
-function startDbWatchdog(deps) {
-	const wd = makeDbWatchdog(deps);
-	const handle = setInterval(() => void wd.tick(), deps.intervalMs);
-	handle.unref?.();
-	return () => clearInterval(handle);
-}
-/**
 * Server boot — idempotent one-time init of the in-process backend: apply
 * migrations, wire the machine gateway's dispatcher into the Scheduler, start
 * the Scheduler + an offline-sweep interval. Guarded on `globalThis` so it
@@ -3865,7 +5685,7 @@ function startDbWatchdog(deps) {
 * from any server-side entry (the standalone machine server / TanStack server
 * fns); the first call boots, the rest share the same instance.
 */
-var boot_exports = /* @__PURE__ */ __exportAll$1({
+var boot_exports = /* @__PURE__ */ __exportAll({
 	ensureServer: () => ensureServer,
 	getArtifactSync: () => getArtifactSync,
 	getCliGateway: () => getCliGateway,
@@ -3882,7 +5702,6 @@ function ensureServer() {
 	return p;
 }
 async function boot() {
-	loginGateEnabled();
 	await runMigrations();
 	await repairTerminalRunLeases();
 	const abort = new AbortController();
@@ -3903,27 +5722,9 @@ async function boot() {
 	const sweep = setInterval(() => void gateway.sweep().catch((err) => logger.error({ err: String(err) }, "sweep tick failed")), ONLINE_TTL_MS);
 	sweep.unref?.();
 	abort.signal.addEventListener("abort", () => clearInterval(sweep), { once: true });
-	const gc = setInterval(() => void gateway.maintainStorage().catch((err) => logger.error({ err: String(err) }, "gc tick failed")), gcIntervalMs());
+	const gc = setInterval(() => void gateway.maintainStorage().catch((err) => logger.error({ err: String(err) }, "gc tick failed")), GC_INTERVAL_MS);
 	gc.unref?.();
 	abort.signal.addEventListener("abort", () => clearInterval(gc), { once: true });
-	if (dbWatchdogEnabled()) {
-		const intervalMs = dbWatchdogIntervalMs();
-		const timeoutMs = dbWatchdogTimeoutMs();
-		const failureThreshold = dbWatchdogFailureThreshold();
-		logger.info({
-			intervalMs,
-			timeoutMs,
-			failureThreshold
-		}, "db watchdog: armed");
-		const stopWatchdog = startDbWatchdog({
-			probe: () => db.execute(sql`select 1`),
-			exit: (code) => process.exit(code),
-			intervalMs,
-			timeoutMs,
-			failureThreshold
-		});
-		abort.signal.addEventListener("abort", () => stopWatchdog(), { once: true });
-	}
 	logger.info("pievo server booted");
 	return {
 		scheduler,
@@ -3944,4 +5745,4 @@ async function getCliGateway() {
 	return (await ensureServer()).cliGateway;
 }
 //#endregion
-export { daemonNeedsUpdate as a, readByteBody as c, statusDefinitionsFromLoop as d, validOptionalPollString as f, validateLoopEdit as h, boot_C472kLwY_exports as i, readJsonBody as l, validPollWireId as m, MIN_DAEMON_VERSION as n, ensureServer as o, validPollCurrentRun as p, POLL_HTTP_BODY_FIELDS as r, getArtifactSync as s, MACHINE_BODY_CAP as t, scheduleFromLoop as u };
+export { listMachines as A, reconciliationStatesForRuns as B, getMachine as C, isOutdated as D, hasRunningRun as E, machineIdFromToken as F, startLoop as G, requestRunCancel as H, machinePresence as I, updateLoop as J, stopLoop as K, mintDeviceToken as L, listRunsBefore as M, loopTags_C6vATFCp_exports as N, listArtifacts as O, loopsForMachine as P, pauseLoop as R, getLoop as S, hasPendingRun as T, safeRelPath as U, requestDeleteLoop as V, sha256 as W, validateLoopTags as X, updateMachine as Y, countRuns as _, canonicalLoopEnvelope as a, forceDeleteMachine as b, ensureServer as c, readJsonBody as d, validOptionalPollString as f, CODING_AGENTS as g, validateLoopEdit as h, boot_CYRi_wez_exports as i, listRuns as j, listLoops as k, getArtifactSync as l, validPollWireId as m, MIN_DAEMON_VERSION as n, canonicalLoopSummary as o, validPollCurrentRun as p, tryDeleteLoop as q, POLL_HTTP_BODY_FIELDS as r, daemonNeedsUpdate as s, MACHINE_BODY_CAP as t, readByteBody as u, createMachine as v, getRun as w, getArtifactFile as x, forceDeleteLoop as y, recentLoopUsage as z };