@runa-ai/runa-cli 0.7.1 → 0.7.3

package/dist/{ci-XY6IKEDC.js → ci-Z4525QW6.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, detectAppSchemas, formatSchemasForSql } from './chunk-XDCHRVE3.js';
+import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, detectAppSchemas, formatSchemasForSql } from './chunk-4XHZQRRK.js';
 import { isPathContained } from './chunk-DRSUEMAK.js';
 import './chunk-QDF7QXBL.js';
-import { getSnapshotStateName, isSnapshotComplete } from './chunk-EMB6IZFT.js';
-import { writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput } from './chunk-HD74F6W2.js';
-import { parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, psqlSyncQuery } from './chunk-7B5C6U2K.js';
+import { getSnapshotStateName, getSnapshotStatePaths, isSnapshotComplete } from './chunk-XVNDDHAF.js';
+import { writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput } from './chunk-FWMGC5FP.js';
+import { parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, psqlSyncQuery } from './chunk-A6A7JIRD.js';
 import { ensureRunaTmpDir, runLogged } from './chunk-6FAU4IGR.js';
 import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
 import { getSafeEnv, getFilteredEnv, redactSecrets } from './chunk-II7VYQEM.js';
-import { init_constants, detectSupabasePorts } from './chunk-VM3IWOT5.js';
+import { init_constants, init_local_supabase, detectLocalSupabasePorts } from './chunk-QSEF4T3Y.js';
 import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
 import './chunk-WJXC4MVY.js';
 import { setOutputFormat } from './chunk-HKUWEGUX.js';
@@ -19,9 +19,9 @@ import { Command } from 'commander';
 import { spawnSync, spawn, execFileSync } from 'child_process';
 import { mkdir, writeFile, appendFile, readFile } from 'fs/promises';
 import path4, { join } from 'path';
-import { createCLILogger, CLIError, syncFromProduction, formatDuration, GITHUB_API, getClassificationForProfile, getStatusIcon, detectDatabasePackage, DATABASE_PACKAGE_CANDIDATES } from '@runa-ai/runa';
+import { CommandOutcomeSchema, createCLILogger, CLIError, syncFromProduction, formatDuration, GITHUB_API, getClassificationForProfile, isTimeoutLikeMessage, buildCommandOutcomeSummary, deriveCommandExitMode, getStatusIcon, detectDatabasePackage, DATABASE_PACKAGE_CANDIDATES } from '@runa-ai/runa';
 import { z } from 'zod';
-import { existsSync, readFileSync, readdirSync, promises, lstatSync, statSync } from 'fs';
+import { existsSync, createWriteStream, readFileSync, readdirSync, statSync, promises, lstatSync } from 'fs';
 import { resolve4 } from 'dns/promises';
 import net, { isIP } from 'net';
 import { fromPromise, setup, assign, createActor } from 'xstate';
@@ -344,9 +344,51 @@ function logNextActions(items) {
 
 // src/commands/ci/utils/ci-summary.ts
 init_esm_shims();
+
+// src/commands/ci/utils/ci-diagnostics.ts
+init_esm_shims();
+var ExecutionOwnerSchema = z.enum(["sdk", "external"]);
+var SupabaseResolutionStrategySchema = z.enum([
+  "assume-ready",
+  "status-polling",
+  "fallback-default"
+]);
+var SupabaseResolutionSourceSchema = z.enum([
+  "assumed-local-config",
+  "status-json",
+  "default-fallback"
+]);
+var SupabaseResolutionDiagnosticsSchema = z.object({
+  strategy: SupabaseResolutionStrategySchema,
+  finalSource: SupabaseResolutionSourceSchema,
+  attempts: z.number().int().nonnegative(),
+  maxAttempts: z.number().int().positive(),
+  sleepSeconds: z.number().int().nonnegative(),
+  waitedMs: z.number().int().nonnegative(),
+  retriesExhausted: z.boolean().optional(),
+  lastError: z.string().optional()
+}).strict();
+var CiDiagnosticsSchema = z.object({
+  setup: z.object({
+    runtimeOwner: ExecutionOwnerSchema.optional(),
+    playwrightOwner: ExecutionOwnerSchema.optional(),
+    supabase: SupabaseResolutionDiagnosticsSchema.optional()
+  }).strict().optional()
+}).strict();
+
+// src/commands/ci/utils/ci-summary.ts
 var CiLayerStatusSchema = z.enum(["passed", "failed", "skipped", "killed", "timeout"]);
 var LayerBlockingLevelSchema = z.enum(["blocking", "warning", "reportOnly"]);
 var CiStepStatusSchema = z.enum(["passed", "failed", "skipped", "killed", "timeout"]);
+var CiStepPhaseSchema = z.enum([
+  "setup",
+  "github",
+  "db",
+  "observability",
+  "build",
+  "test",
+  "finalize"
+]);
 var CiSummarySchema = z.object({
   version: z.string(),
   mode: z.enum(["github-actions", "local"]),
@@ -357,12 +399,22 @@ var CiSummarySchema = z.object({
   durationMs: z.number().int().nonnegative(),
   repoKind: z.enum(["monorepo", "pj-repo", "unknown"]),
   detected: z.record(z.string(), z.unknown()),
+  diagnostics: CiDiagnosticsSchema.default({}),
   steps: z.record(
     z.string(),
     z.object({
       status: CiStepStatusSchema,
       exitCode: z.number().int().optional(),
-      logPath: z.string().optional()
+      logPath: z.string().optional(),
+      error: z.string().optional(),
+      reason: z.string().optional(),
+      title: z.string().optional(),
+      phase: CiStepPhaseSchema.optional(),
+      parentStep: z.string().optional(),
+      optional: z.boolean().optional(),
+      startedAt: z.string().optional(),
+      endedAt: z.string().optional(),
+      durationMs: z.number().int().nonnegative().optional()
     }).strict()
   ).default({}),
   layers: z.record(
@@ -389,6 +441,7 @@ var CiSummarySchema = z.object({
       details: z.string().optional()
     }).strict()
   ).default([]),
+  dbOutcome: CommandOutcomeSchema.optional(),
   /** Blocking policy metadata for DB deploy gating */
   blockingPolicy: z.object({
     /** CI profile (runa-strict or pj-stable) */
@@ -517,9 +570,8 @@ var IssueCommentSchema = z.object({
   id: z.number().int(),
   body: z.string().nullable()
 }).passthrough();
-async function upsertIssueComment(params) {
+async function findIssueCommentByMarker(params) {
   let page = 1;
-  let existingId = null;
   while (true) {
     const raw = await githubRequest({
       method: "GET",
@@ -530,28 +582,57 @@ async function upsertIssueComment(params) {
     for (const c of arr) {
       const body = c.body ?? "";
       if (body.includes(params.marker)) {
-        existingId = c.id;
-        break;
+        return { id: c.id, body };
       }
     }
-    if (existingId) break;
     if (arr.length < 100) break;
     page += 1;
     if (page > 20) break;
   }
-  if (existingId) {
+  return null;
+}
+var commentIdCache = /* @__PURE__ */ new Map();
+var upsertChains = /* @__PURE__ */ new Map();
+function commentCacheKey(params) {
+  return `${params.repo.owner}/${params.repo.repo}#${params.issueNumber}:${params.marker}`;
+}
+async function upsertIssueComment(params) {
+  const key = commentCacheKey(params);
+  const previous = upsertChains.get(key) ?? Promise.resolve();
+  const current = previous.catch(() => {
+  }).then(() => doUpsertIssueComment(params, key));
+  upsertChains.set(key, current);
+  return current;
+}
+async function doUpsertIssueComment(params, key) {
+  const cachedId = commentIdCache.get(key);
+  if (cachedId) {
     await githubRequest({
       method: "PATCH",
-      path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/comments/${existingId}`,
+      path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/comments/${cachedId}`,
       body: { body: params.body }
     });
     return;
   }
-  await githubRequest({
+  const existing = await findIssueCommentByMarker(params);
+  if (existing) {
+    commentIdCache.set(key, existing.id);
+    await githubRequest({
+      method: "PATCH",
+      path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/comments/${existing.id}`,
+      body: { body: params.body }
+    });
+    return;
+  }
+  const result = await githubRequest({
     method: "POST",
     path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/${params.issueNumber}/comments`,
     body: { body: params.body }
   });
+  const commentId = result?.id;
+  if (commentId) {
+    commentIdCache.set(key, commentId);
+  }
 }
 async function addIssueLabels(params) {
   await githubRequest({
@@ -762,7 +843,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
     });
   }
 }
-async function detectRisks(repoRoot, tmpDir) {
+async function detectRisks(repoRoot, tmpDir, timeoutMs) {
   const logFile = path4.join(tmpDir, "db-risks.log");
   try {
     const env = getFilteredEnv();
@@ -772,13 +853,14 @@ async function detectRisks(repoRoot, tmpDir) {
       label: "db:risks",
       command: "pnpm",
       args: ["exec", "runa", "db", "risks"],
-      logFile
+      logFile,
+      timeoutMs
     });
   } catch (error) {
     let logContent = "";
     try {
-      const { readFileSync: readFileSync4 } = await import('fs');
-      logContent = readFileSync4(logFile, "utf-8");
+      const { readFileSync: readFileSync5 } = await import('fs');
+      logContent = readFileSync5(logFile, "utf-8");
     } catch {
     }
     const isInitialDeployment = logContent.includes("No common ancestor") || logContent.includes("INITIAL DEPLOYMENT");
@@ -799,7 +881,7 @@ To bypass (if changes are intentional):
     throw enhancedError;
   }
 }
-async function snapshotCreate(repoRoot, tmpDir, productionDbUrlAdmin, commit) {
+async function snapshotCreate(repoRoot, tmpDir, productionDbUrlAdmin, commit, timeoutMs) {
   await runLogged({
     cwd: repoRoot,
     env: {
@@ -809,10 +891,11 @@ async function snapshotCreate(repoRoot, tmpDir, productionDbUrlAdmin, commit) {
     label: "snapshot create production",
     command: "pnpm",
     args: ["exec", "runa", "db", "snapshot", "create", "production", "--commit", commit],
-    logFile: path4.join(tmpDir, "snapshot-create.log")
+    logFile: path4.join(tmpDir, "snapshot-create.log"),
+    timeoutMs
   });
 }
-async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin) {
+async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin, timeoutMs) {
   await runLogged({
     cwd: repoRoot,
     env: {
@@ -822,7 +905,8 @@ async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin) {
     label: "snapshot restore production (latest)",
     command: "pnpm",
     args: ["exec", "runa", "db", "snapshot", "restore", "production", "--latest", "--auto-approve"],
-    logFile: path4.join(tmpDir, "snapshot-restore.log")
+    logFile: path4.join(tmpDir, "snapshot-restore.log"),
+    timeoutMs
   });
 }
 function parseApplyLog(logContent) {
@@ -901,13 +985,14 @@ async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, pro
     label: "db apply production",
     command: "pnpm",
     args,
-    logFile: logPath
+    logFile: logPath,
+    timeoutMs: options?.timeoutMs
   });
   const totalMs = Date.now() - startTime;
   let logContent = "";
   try {
-    const { readFileSync: readFileSync4 } = await import('fs');
-    logContent = readFileSync4(logPath, "utf-8");
+    const { readFileSync: readFileSync5 } = await import('fs');
+    logContent = readFileSync5(logPath, "utf-8");
   } catch {
   }
   const parsed = parseApplyLog(logContent);
@@ -1145,6 +1230,7 @@ function createInitialSummary(params) {
     durationMs: 0,
     repoKind: resolveRepoKind(),
     detected: {},
+    diagnostics: {},
     steps: {},
     layers: {},
     errors: []
@@ -1201,6 +1287,19 @@ function buildCiProdApplyStepSummaryMarkdown(params) {
   lines.push("");
   lines.push(`**Duration**: ${duration}`);
   lines.push("");
+  if (summary.dbOutcome) {
+    lines.push(`**Exit mode**: \`${summary.dbOutcome.exitMode}\``);
+    const failedPhase = summary.dbOutcome.phases.find(
+      (phase) => phase.status === "failed" || phase.status === "timeout"
+    );
+    if (failedPhase) {
+      lines.push(`**Failed phase**: \`${failedPhase.id}\``);
+    }
+    if (summary.dbOutcome.summary.warnings > 0) {
+      lines.push(`**Warnings**: ${summary.dbOutcome.summary.warnings}`);
+    }
+    lines.push("");
+  }
   if (summary.errors.length > 0) {
     lines.push("### \u274C Errors");
     lines.push("");
@@ -1215,6 +1314,9 @@ function buildCiProdApplyStepSummaryMarkdown(params) {
   lines.push(`- Command: \`${summary.command}\``);
   lines.push(`- Mode: \`${summary.mode}\``);
   lines.push(`- Summary: \`${params.summaryPath}\``);
+  if (summary.dbOutcome) {
+    lines.push(`- DB exit mode: \`${summary.dbOutcome.exitMode}\``);
+  }
   lines.push("");
   lines.push("</details>");
   lines.push("");
@@ -1471,7 +1573,7 @@ var CiProdApplyWorkflow = class {
           return null;
         },
         run: async (ctx) => {
-          await detectRisks(ctx.repoRoot, ctx.tmpDir);
+          await detectRisks(ctx.repoRoot, ctx.tmpDir, ctx.options.riskTimeoutMs);
         }
       },
       {
@@ -1483,7 +1585,8 @@ var CiProdApplyWorkflow = class {
             ctx.repoRoot,
             ctx.tmpDir,
             ctx.inputs.productionDatabaseUrlAdmin,
-            ctx.inputs.githubSha
+            ctx.inputs.githubSha,
+            ctx.options.snapshotTimeoutMs
           );
         }
       },
@@ -1514,7 +1617,8 @@ var CiProdApplyWorkflow = class {
               {
                 allowDataLoss: ctx.options.allowDataLoss === true,
                 confirmAuthzUpdate: ctx.options.confirmAuthzUpdate === true,
-                maxLockWaitMs: typeof ctx.options.maxLockWaitMs === "number" ? ctx.options.maxLockWaitMs : void 0
+                maxLockWaitMs: typeof ctx.options.maxLockWaitMs === "number" ? ctx.options.maxLockWaitMs : void 0,
+                timeoutMs: ctx.options.applyTimeoutMs
               }
             );
           } catch (error) {
@@ -1522,7 +1626,8 @@ var CiProdApplyWorkflow = class {
             await snapshotRestoreLatest(
               ctx.repoRoot,
               ctx.tmpDir,
-              ctx.inputs.productionDatabaseUrlAdmin
+              ctx.inputs.productionDatabaseUrlAdmin,
+              ctx.options.snapshotTimeoutMs
             );
             throw error;
           }
@@ -1575,20 +1680,79 @@ var CiProdApplyWorkflow = class {
   async run() {
     logPlan(this.steps.map((step) => ({ id: step.id, description: step.description })));
     const total = this.steps.length;
+    const startedAtMs = Date.now();
+    const phases = [];
     for (let i = 0; i < total; i++) {
       const step = this.steps[i];
       const prefix = `[DEBUG] Step ${i + 1}/${total}: ${step.description}`;
       const skipResult = step.shouldSkip?.(this.ctx);
       if (skipResult) {
         console.log(`${prefix} SKIPPED (${skipResult.reason})`);
+        phases.push({
+          id: step.id,
+          label: step.description,
+          status: "skipped",
+          warningCount: 0
+        });
         continue;
       }
       console.log(`${prefix}...`);
       const startedAt = Date.now();
-      await step.run(this.ctx);
-      const duration = Date.now() - startedAt;
-      console.log(`${prefix} done (${duration}ms)`);
+      try {
+        await step.run(this.ctx);
+        const duration = Date.now() - startedAt;
+        phases.push({
+          id: step.id,
+          label: step.description,
+          status: "passed",
+          startedAt: new Date(startedAt).toISOString(),
+          endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          durationMs: duration
+        });
+        console.log(`${prefix} done (${duration}ms)`);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const timeoutLike = isTimeoutLikeMessage(message);
+        phases.push({
+          id: step.id,
+          label: step.description,
+          status: timeoutLike ? "timeout" : "failed",
+          startedAt: new Date(startedAt).toISOString(),
+          endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          durationMs: Date.now() - startedAt,
+          error: {
+            code: timeoutLike ? "PHASE_TIMEOUT" : "CI_PROD_APPLY_FAILED",
+            message,
+            retryable: timeoutLike,
+            phase: step.id
+          }
+        });
+        this.ctx.summary.dbOutcome = {
+          command: "runa ci prod-apply",
+          exitMode: deriveCommandExitMode(phases),
+          startedAt: new Date(startedAtMs).toISOString(),
+          endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          durationMs: Date.now() - startedAtMs,
+          phases,
+          warnings: [],
+          errors: phases.map((phase) => phase.error).filter((value) => value != null),
+          summary: buildCommandOutcomeSummary(phases)
+        };
+        throw error;
+      }
     }
+    const outcome = {
+      command: "runa ci prod-apply",
+      exitMode: deriveCommandExitMode(phases),
+      startedAt: new Date(startedAtMs).toISOString(),
+      endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      durationMs: Date.now() - startedAtMs,
+      phases,
+      warnings: [],
+      errors: [],
+      summary: buildCommandOutcomeSummary(phases)
+    };
+    this.ctx.summary.dbOutcome = outcome;
   }
 };
 
@@ -1807,6 +1971,18 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
   "--max-lock-wait-ms <ms>",
   "Maximum time to wait for lock acquisition (default: 30000)",
   (value) => Number.parseInt(value, 10)
+).option(
+  "--risk-timeout-ms <ms>",
+  "Maximum time for risk detection (ms)",
+  (value) => Number.parseInt(value, 10)
+).option(
+  "--snapshot-timeout-ms <ms>",
+  "Maximum time for snapshot create/restore (ms)",
+  (value) => Number.parseInt(value, 10)
+).option(
+  "--apply-timeout-ms <ms>",
+  "Maximum time for production schema apply (ms)",
+  (value) => Number.parseInt(value, 10)
 ).option("--skip-notify", "Skip external notification (RUNA_APP_URL)", false).option("--skip-github-label", "Skip adding db-applied label (GitHub Actions only)", false).option(
   "--skip-risks",
   "Skip schema risk detection (use for trusted deployments or initial setup)",
@@ -2295,6 +2471,7 @@ async function stopApp(pid, cleanupStreams) {
 init_esm_shims();
 async function runAppBuild(params) {
   const { repoRoot, tmpDir, env } = params;
+  const startedAtMs = Date.now();
   try {
     const hasTurbo = existsSync(path4.join(repoRoot, "turbo.json"));
     const hasApps = existsSync(path4.join(repoRoot, "apps"));
@@ -2308,33 +2485,61 @@ async function runAppBuild(params) {
       args,
       logFile: path4.join(tmpDir, "build.log")
     });
-    return { passed: true };
+    return { passed: true, startedAtMs };
   } catch (error) {
     return {
       passed: false,
+      startedAtMs,
       error: error instanceof Error ? error.message : String(error)
     };
   }
 }
+function wasManifestGeneratedDuringBuild(repoRoot, buildStartedAtMs) {
+  const manifestPath = path4.join(repoRoot, ".runa", "manifests", "manifest.json");
+  if (!existsSync(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifestStat = statSync(manifestPath);
+    return manifestStat.mtimeMs >= buildStartedAtMs;
+  } catch {
+    return false;
+  }
+}
 async function runManifestGenerate(params) {
-  const { repoRoot, tmpDir, env } = params;
+  const { repoRoot, tmpDir, env, buildStartedAtMs } = params;
+  if (wasManifestGeneratedDuringBuild(repoRoot, buildStartedAtMs)) {
+    console.log("\u25B6 manifest: reusing manifest generated during build");
+    return { generated: true };
+  }
   try {
     await runLogged({
       cwd: repoRoot,
       env,
       label: "manifest:generate",
       command: "pnpm",
-      args: ["manifest:generate"],
+      args: ["exec", "runa", "manifest"],
       logFile: path4.join(tmpDir, "manifest-generate.log")
     });
     return { generated: true };
   } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (isOptionalManifestError(message)) {
+      return {
+        generated: null,
+        error: message
+      };
+    }
     return {
       generated: false,
-      error: error instanceof Error ? error.message : String(error)
+      error: message
     };
   }
 }
+function isOptionalManifestError(message) {
+  const normalized = message.toLowerCase();
+  return normalized.includes("enoent") && normalized.includes("docs/wip") || normalized.includes("no such file") && normalized.includes("docs/wip") || normalized.includes("strict_detect_manifest_required");
+}
 async function runPlaywrightInstall(params) {
   const { repoRoot, tmpDir, isCI } = params;
   try {
@@ -2362,7 +2567,12 @@ var buildAndPlaywrightActor = fromPromise(
       const buildResult = await runAppBuild({ repoRoot, tmpDir, env });
       let manifestResult = { generated: false };
       if (buildResult.passed) {
-        manifestResult = await runManifestGenerate({ repoRoot, tmpDir, env });
+        manifestResult = await runManifestGenerate({
+          repoRoot,
+          tmpDir,
+          env,
+          buildStartedAtMs: buildResult.startedAtMs
+        });
       }
       return {
         buildPassed: buildResult.passed,
@@ -2379,7 +2589,12 @@ var buildAndPlaywrightActor = fromPromise(
         if (!buildResult.passed) {
           return { buildResult, manifestResult: { generated: false, error: void 0 } };
         }
-        const manifestResult = await runManifestGenerate({ repoRoot, tmpDir, env });
+        const manifestResult = await runManifestGenerate({
+          repoRoot,
+          tmpDir,
+          env,
+          buildStartedAtMs: buildResult.startedAtMs
+        });
         return { buildResult, manifestResult };
       })(),
       runPlaywrightInstall({ repoRoot, tmpDir, isCI })
@@ -2399,7 +2614,7 @@ var buildAndPlaywrightActor = fromPromise(
       manifestGenerated,
       playwrightInstalled,
       buildError: buildPassed ? void 0 : buildError,
-      manifestError: manifestGenerated ? void 0 : manifestError,
+      manifestError: manifestGenerated === true ? void 0 : manifestError,
       playwrightError: playwrightInstalled ? void 0 : playwrightError
     };
   }
@@ -2485,6 +2700,11 @@ init_esm_shims();
 
 // src/commands/ci/machine/actors/db/apply-seeds.ts
 init_esm_shims();
+
+// src/commands/ci/utils/db-url-utils.ts
+init_esm_shims();
+
+// src/commands/ci/machine/actors/db/apply-seeds.ts
 var applySeedsActor = fromPromise(
   async ({ input }) => {
     const { repoRoot, tmpDir, databaseUrl } = input;
@@ -2518,6 +2738,16 @@ init_esm_shims();
 
 // src/commands/ci/machine/actors/db/schema-canonical-diff.ts
 init_esm_shims();
+var SECURITY_METADATA_KINDS = /* @__PURE__ */ new Set([
+  "schema_acl",
+  "table_acl",
+  "function_acl"
+]);
+var DESCRIPTIVE_METADATA_KINDS = /* @__PURE__ */ new Set([
+  "schema_comment",
+  "table_comment",
+  "function_comment"
+]);
 function createUnavailableCanonicalSnapshot(error) {
   return {
     available: false,
@@ -2548,6 +2778,11 @@ var EXCLUDED_SCHEMAS = [
 function normalizeWhitespace(value) {
   return (value ?? "").replace(/\s+/g, " ").trim();
 }
+function normalizeAcl(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) return "";
+  return trimmed.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0).sort((left, right) => left.localeCompare(right)).join(",");
+}
 function stableHash(payload) {
   return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
 }
@@ -2787,6 +3022,128 @@ async function queryTriggers(sql, schemaList) {
     ORDER BY n.nspname, c.relname, t.tgname
   `;
 }
+async function querySchemaAclMetadata(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      n.nspname AS object_name,
+      n.nspname AS object_key,
+      format('%I schema ACL', n.nspname) AS object_label,
+      COALESCE(
+        (
+          SELECT string_agg(acl::text, ',' ORDER BY acl::text)
+          FROM unnest(COALESCE(n.nspacl, acldefault('n', n.nspowner))) acl
+        ),
+        ''
+      ) AS value
+    FROM pg_namespace n
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+    ORDER BY n.nspname
+  `;
+}
+async function querySchemaCommentMetadata(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      n.nspname AS object_name,
+      n.nspname AS object_key,
+      format('%I schema comment', n.nspname) AS object_label,
+      COALESCE(obj_description(n.oid, 'pg_namespace'), '') AS value
+    FROM pg_namespace n
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+    ORDER BY n.nspname
+  `;
+}
+async function queryTableAclMetadata(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS object_name,
+      format('%I.%I', n.nspname, c.relname) AS object_key,
+      format('%I.%I ACL', n.nspname, c.relname) AS object_label,
+      COALESCE(
+        (
+          SELECT string_agg(acl::text, ',' ORDER BY acl::text)
+          FROM unnest(COALESCE(c.relacl, acldefault('r', c.relowner))) acl
+        ),
+        ''
+      ) AS value
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+    ORDER BY n.nspname, c.relname
+  `;
+}
+async function queryTableCommentMetadata(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS object_name,
+      format('%I.%I', n.nspname, c.relname) AS object_key,
+      format('%I.%I comment', n.nspname, c.relname) AS object_label,
+      COALESCE(obj_description(c.oid, 'pg_class'), '') AS value
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+    ORDER BY n.nspname, c.relname
+  `;
+}
+async function queryFunctionAclMetadata(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      p.proname AS object_name,
+      format('%I.%I(%s)', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_key,
+      format('%I.%I(%s) ACL', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_label,
+      COALESCE(
+        (
+          SELECT string_agg(acl::text, ',' ORDER BY acl::text)
+          FROM unnest(COALESCE(p.proacl, acldefault('f', p.proowner))) acl
+        ),
+        ''
+      ) AS value
+    FROM pg_proc p
+    JOIN pg_namespace n ON p.pronamespace = n.oid
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND p.prokind = 'f'
+      AND NOT EXISTS (
+        SELECT 1 FROM pg_depend d
+        WHERE d.objid = p.oid
+          AND d.deptype = 'e'
+      )
+      AND p.proname NOT LIKE 'supabase_%'
+      AND p.proname NOT LIKE 'postgrest_%'
+      AND p.proname NOT LIKE 'pgrst_%'
+      AND p.proname NOT LIKE '_pgrst_%'
+    ORDER BY n.nspname, p.proname
+  `;
+}
+async function queryFunctionCommentMetadata(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      p.proname AS object_name,
+      format('%I.%I(%s)', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_key,
+      format('%I.%I(%s) comment', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_label,
+      COALESCE(obj_description(p.oid, 'pg_proc'), '') AS value
+    FROM pg_proc p
+    JOIN pg_namespace n ON p.pronamespace = n.oid
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND p.prokind = 'f'
+      AND NOT EXISTS (
+        SELECT 1 FROM pg_depend d
+        WHERE d.objid = p.oid
+          AND d.deptype = 'e'
+      )
+      AND p.proname NOT LIKE 'supabase_%'
+      AND p.proname NOT LIKE 'postgrest_%'
+      AND p.proname NOT LIKE 'pgrst_%'
+      AND p.proname NOT LIKE '_pgrst_%'
+    ORDER BY n.nspname, p.proname
+  `;
+}
 function rowsToObjects(kind, rows) {
   return rows.map(
     (row) => createCanonicalObject(
@@ -2799,6 +3156,17 @@ function rowsToObjects(kind, rows) {
     )
   );
 }
+function metadataRowsToObjects(kind, rows) {
+  return rows.map(
+    (row) => createCanonicalObject(
+      kind,
+      row.schema_name,
+      row.object_key,
+      row.object_label,
+      kind.endsWith("_acl") ? normalizeAcl(row.value) : normalizeWhitespace(row.value)
+    )
+  );
+}
 async function getCanonicalSchemaSnapshot(databaseUrl) {
   let sql = null;
   try {
@@ -2814,17 +3182,35 @@ async function getCanonicalSchemaSnapshot(databaseUrl) {
       return { available: true, objects: [] };
     }
     const schemaList = buildSchemaListSql(userSchemas);
-    const [columns, flags, constraints, functions, policies, indexes, triggers] = await Promise.all(
-      [
-        queryTableColumns(sql, schemaList),
-        queryTableFlags(sql, schemaList),
-        queryTableConstraints(sql, schemaList),
-        queryFunctions(sql, schemaList),
-        queryPolicies(sql, schemaList),
-        queryIndexes(sql, schemaList),
-        queryTriggers(sql, schemaList)
-      ]
-    );
+    const [
+      columns,
+      flags,
+      constraints,
+      functions,
+      policies,
+      indexes,
+      triggers,
+      schemaAcl,
+      schemaComments,
+      tableAcl,
+      tableComments,
+      functionAcl,
+      functionComments
+    ] = await Promise.all([
+      queryTableColumns(sql, schemaList),
+      queryTableFlags(sql, schemaList),
+      queryTableConstraints(sql, schemaList),
+      queryFunctions(sql, schemaList),
+      queryPolicies(sql, schemaList),
+      queryIndexes(sql, schemaList),
+      queryTriggers(sql, schemaList),
+      querySchemaAclMetadata(sql, schemaList),
+      querySchemaCommentMetadata(sql, schemaList),
+      queryTableAclMetadata(sql, schemaList),
+      queryTableCommentMetadata(sql, schemaList),
+      queryFunctionAclMetadata(sql, schemaList),
+      queryFunctionCommentMetadata(sql, schemaList)
+    ]);
     return {
       available: true,
       objects: [
@@ -2832,7 +3218,13 @@ async function getCanonicalSchemaSnapshot(databaseUrl) {
         ...rowsToObjects("function", functions),
         ...rowsToObjects("policy", policies),
         ...rowsToObjects("index", indexes),
-        ...rowsToObjects("trigger", triggers)
+        ...rowsToObjects("trigger", triggers),
+        ...metadataRowsToObjects("schema_acl", schemaAcl),
+        ...metadataRowsToObjects("schema_comment", schemaComments),
+        ...metadataRowsToObjects("table_acl", tableAcl),
+        ...metadataRowsToObjects("table_comment", tableComments),
+        ...metadataRowsToObjects("function_acl", functionAcl),
+        ...metadataRowsToObjects("function_comment", functionComments)
       ].sort((a, b) => a.key.localeCompare(b.key))
     };
   } catch (error) {
@@ -2858,6 +3250,18 @@ function buildSignatureBuckets(objects) {
   }
   return buckets;
 }
+function findRenamedIndexTarget(referenceObject, targetSignatureBuckets, matchedTargetKeys) {
+  if (referenceObject.kind !== "index") {
+    return void 0;
+  }
+  const renameBucket = targetSignatureBuckets.get(
+    `${referenceObject.kind}:${referenceObject.schema}:${referenceObject.signature}`
+  ) ?? [];
+  return renameBucket.find((candidate) => !matchedTargetKeys.has(candidate.key));
+}
+function isExtraTargetObject(targetObject, matchedTargetKeys, referenceKeys) {
+  return !matchedTargetKeys.has(targetObject.key) && !referenceKeys.has(targetObject.key);
+}
 function compareCanonicalSnapshots(reference, target) {
   const missing = [];
   const extra = [];
@@ -2865,6 +3269,7 @@ function compareCanonicalSnapshots(reference, target) {
   const renamed = [];
   const targetByKey = buildObjectMap(target);
   const targetSignatureBuckets = buildSignatureBuckets(target.objects);
+  const referenceKeys = new Set(reference.objects.map((object) => object.key));
   const matchedTargetKeys = /* @__PURE__ */ new Set();
   for (const referenceObject of reference.objects) {
     const matchedTarget = targetByKey.get(referenceObject.key);
@@ -2875,21 +3280,20 @@ function compareCanonicalSnapshots(reference, target) {
       }
       continue;
     }
-    if (referenceObject.kind === "index") {
-      const renameBucket = targetSignatureBuckets.get(
-        `${referenceObject.kind}:${referenceObject.schema}:${referenceObject.signature}`
-      ) ?? [];
-      const renamedTarget = renameBucket.find((candidate) => !matchedTargetKeys.has(candidate.key));
-      if (renamedTarget) {
-        matchedTargetKeys.add(renamedTarget.key);
-        renamed.push({ reference: referenceObject, target: renamedTarget });
-        continue;
-      }
+    const renamedTarget = findRenamedIndexTarget(
+      referenceObject,
+      targetSignatureBuckets,
+      matchedTargetKeys
+    );
+    if (renamedTarget) {
+      matchedTargetKeys.add(renamedTarget.key);
+      renamed.push({ reference: referenceObject, target: renamedTarget });
+      continue;
     }
     missing.push(referenceObject);
   }
   for (const targetObject of target.objects) {
-    if (!matchedTargetKeys.has(targetObject.key) && !reference.objects.some((candidate) => candidate.key === targetObject.key)) {
+    if (isExtraTargetObject(targetObject, matchedTargetKeys, referenceKeys)) {
       extra.push(targetObject);
     }
   }
@@ -2940,6 +3344,25 @@ function summarizeCanonicalDiffBySchema(diff) {
 function hasCanonicalChanges(diff) {
   return diff.missing.length > 0 || diff.extra.length > 0 || diff.changed.length > 0 || diff.renamed.length > 0;
 }
+function classifyCanonicalDiff(diff) {
+  const kinds = /* @__PURE__ */ new Set();
+  for (const object of diff.missing) kinds.add(object.kind);
+  for (const object of diff.extra) kinds.add(object.kind);
+  for (const pair of diff.changed) kinds.add(pair.reference.kind);
+  for (const pair of diff.renamed) kinds.add(pair.reference.kind);
+  const orderedKinds = Array.from(kinds).sort();
+  const securityMetadata = orderedKinds.some((kind) => SECURITY_METADATA_KINDS.has(kind));
+  const descriptiveMetadata = orderedKinds.some((kind) => DESCRIPTIVE_METADATA_KINDS.has(kind));
+  const structural = orderedKinds.some(
+    (kind) => !SECURITY_METADATA_KINDS.has(kind) && !DESCRIPTIVE_METADATA_KINDS.has(kind)
+  );
+  return {
+    kinds: orderedKinds,
+    structural,
+    securityMetadata,
+    descriptiveMetadata
+  };
+}
 
 // src/commands/ci/machine/actors/db/schema-stats.ts
 init_esm_shims();
@@ -3158,6 +3581,9 @@ function formatTotalStatsCompact(stats) {
   parts.push(`${stats.triggers}Tr`);
   return parts.join(" ");
 }
+function hasStatsDiff(a, b) {
+  return a.tables !== b.tables || a.functions !== b.functions || a.policies !== b.policies || a.indexes !== b.indexes || a.triggers !== b.triggers;
+}
 function hasDisplayedStatsDiff(a, b) {
   return a.tables !== b.tables || a.functions !== b.functions || a.policies !== b.policies || a.indexes !== b.indexes;
 }
@@ -3283,6 +3709,9 @@ function unavailableStats(error) {
     canonicalSnapshot: createUnavailableCanonicalSnapshot(error)
   };
 }
+function emptySchemaStats() {
+  return { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 };
+}
 function cloneEnvironmentStats(stats) {
   return {
     ...stats,
@@ -3308,11 +3737,85 @@ async function collectEnvironmentStats(dbUrl, label, includeSchemas = false) {
     return null;
   }
   const stats = await getDbSchemaStats(dbUrl);
-  stats.canonicalSnapshot = await getCanonicalSchemaSnapshot(dbUrl);
   stats.available = true;
   logSchemaStats(label, stats, includeSchemas);
   return stats;
 }
+async function collectCanonicalSnapshot(stats, dbUrl, label) {
+  if (!stats || !dbUrl || stats.available === false) {
+    return;
+  }
+  console.log(`[schema-stats] Collecting ${label} semantic snapshot...`);
+  stats.canonicalSnapshot = await getCanonicalSchemaSnapshot(dbUrl);
+}
+function getSchemaNames(reference, target) {
+  return Array.from(
+    /* @__PURE__ */ new Set([...Object.keys(reference.schemas), ...Object.keys(target.schemas)])
+  ).sort();
+}
+function getSchemaOrEmpty(stats, schemaName) {
+  return stats.schemas[schemaName] ?? emptySchemaStats();
+}
+function hasAnySchemaStatsDiff(reference, target) {
+  for (const schemaName of getSchemaNames(reference, target)) {
+    if (hasStatsDiff(getSchemaOrEmpty(reference, schemaName), getSchemaOrEmpty(target, schemaName))) {
+      return true;
+    }
+  }
+  return false;
+}
+function hasUnexpectedCountDrift(reference, target, expectedDrift) {
+  const fields = [
+    "tables",
+    "functions",
+    "policies",
+    "indexes",
+    "triggers"
+  ];
+  for (const schemaName of getSchemaNames(reference, target)) {
+    const referenceStats = getSchemaOrEmpty(reference, schemaName);
+    const targetStats = getSchemaOrEmpty(target, schemaName);
+    for (const field of fields) {
+      if (referenceStats[field] === targetStats[field]) continue;
+      const expected = expectedDrift.find(
+        (entry) => entry.field === field && (entry.schemas === void 0 || entry.schemas.includes(schemaName))
+      );
+      if (!expected) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function hasUnexpectedIndexDrift(reference, target, expectedDrift) {
+  const diff = compareIndexLists(reference, target);
+  if (!hasIndexDiff(diff)) return false;
+  const touchedSchemas = /* @__PURE__ */ new Set([
+    ...diff.missing.map((index) => index.schema),
+    ...diff.extra.map((index) => index.schema)
+  ]);
+  for (const schemaName of touchedSchemas) {
+    const expected = findExpectedDrift(schemaName, "I", expectedDrift);
+    if (!expected) {
+      return true;
+    }
+  }
+  return false;
+}
+function shouldCollectProductionSemanticSnapshot(params) {
+  const { reference, production, expectedDrift = [] } = params;
+  if (!production) return false;
+  if (reference.available === false || production.available === false) return false;
+  const hasUnexpectedBasicDrift = hasUnexpectedCountDrift(reference, production, expectedDrift) || hasUnexpectedIndexDrift(reference, production, expectedDrift);
+  if (hasUnexpectedBasicDrift) {
+    return false;
+  }
+  return true;
+}
+function shouldCollectCiSemanticSnapshot(reference, ci) {
+  if (reference.available === false || ci.available === false) return false;
+  return !hasAnySchemaStatsDiff(reference, ci) && !hasIndexDiff(compareIndexLists(reference, ci));
+}
 function resolveSettledStats(result, failureLabel) {
   if (result.status === "fulfilled" && result.value) {
     return result.value;
@@ -3355,7 +3858,11 @@ function createReferenceDb(sourceDbUrl) {
   }
   return { dsn: buildShadowDsn(sourceDbUrl, dbName), dbName };
 }
+var REFERENCE_DB_NAME_PATTERN = /^ci_schema_ref_[0-9a-f]{12}$/;
 function dropReferenceDb(sourceDbUrl, dbName) {
+  if (!REFERENCE_DB_NAME_PATTERN.test(dbName)) {
+    throw new Error(`Invalid reference DB name: ${dbName}`);
+  }
   const adminDsn = buildAdminDsn(sourceDbUrl);
   psqlSyncQuery({
     databaseUrl: adminDsn,
@@ -3368,14 +3875,17 @@ function dropReferenceDb(sourceDbUrl, dbName) {
   });
   psqlSyncQuery({
     databaseUrl: adminDsn,
-    sql: `DROP DATABASE IF EXISTS ${dbName}`,
+    sql: `DROP DATABASE IF EXISTS "${dbName}"`,
     timeout: 3e4
   });
 }
-async function buildReferenceStats(repoRoot, tmpDir, sourceDbUrl) {
+async function buildReferenceStatsSession(repoRoot, tmpDir, sourceDbUrl) {
   if (!sourceDbUrl) return null;
   const referenceDb = createReferenceDb(sourceDbUrl);
   const logFile = path4.join(tmpDir, "ci-reference-db-apply.log");
+  const cleanup = () => {
+    dropReferenceDb(sourceDbUrl, referenceDb.dbName);
+  };
   try {
     const result = await execa(
       "pnpm",
@@ -3396,27 +3906,56 @@ ${result.stderr || ""}`;
       throw new Error(`Failed to build reference DB: ${fullOutput.substring(0, 1e3)}`);
     }
     await (await import('fs/promises')).writeFile(logFile, fullOutput);
-    return collectEnvironmentStats(referenceDb.dsn, "Reference", true);
-  } finally {
-    dropReferenceDb(sourceDbUrl, referenceDb.dbName);
+    const stats = await collectEnvironmentStats(referenceDb.dsn, "Reference", true);
+    if (!stats) {
+      cleanup();
+      return null;
+    }
+    return {
+      stats,
+      dsn: referenceDb.dsn,
+      cleanup
+    };
+  } catch (error) {
+    cleanup();
+    throw error;
   }
 }
 async function resolveReferenceAndCiStats(params) {
-  const { repoRoot, tmpDir, referenceDbUrl, ciDbUrl, referenceStrategy } = params;
+  const { repoRoot, tmpDir, referenceDbUrl, ciDbUrl, referenceStrategy} = params;
   if (referenceStrategy === "reuse-ci" && ciDbUrl) {
     console.log(
       "[schema-stats] Reusing synced CI database as reference schema (skip temporary rebuild)"
     );
     const [ciResult2] = await Promise.allSettled([collectEnvironmentStats(ciDbUrl, "CI")]);
-    const ci = resolveSettledStats(ciResult2, "CI");
-    const reference = ci.available === false ? unavailableStats(ci.error ?? "CI database is unavailable for reference schema reuse") : cloneEnvironmentStats(ci);
-    return [reference, ci];
+    const ci2 = resolveSettledStats(ciResult2, "CI");
+    const reference2 = ci2.available === false ? unavailableStats(ci2.error ?? "CI database is unavailable for reference schema reuse") : cloneEnvironmentStats(ci2);
+    return {
+      reference: reference2,
+      ci: ci2,
+      referenceSession: null
+    };
   }
-  const [referenceResult, ciResult] = await Promise.allSettled([
-    buildReferenceStats(repoRoot, tmpDir, referenceDbUrl),
+  const [referenceSessionResult, ciResult] = await Promise.allSettled([
+    buildReferenceStatsSession(repoRoot, tmpDir, referenceDbUrl),
     collectEnvironmentStats(ciDbUrl, "CI")
   ]);
-  return [resolveSettledStats(referenceResult, "reference"), resolveSettledStats(ciResult, "CI")];
+  const referenceSession = referenceSessionResult.status === "fulfilled" ? referenceSessionResult.value : null;
+  let reference;
+  if (referenceSessionResult.status === "fulfilled") {
+    reference = referenceSession?.stats ?? unavailableStats("reference database URL is not available for schema comparison");
+  } else {
+    console.warn(
+      `[schema-stats] Failed to query reference database: ${referenceSessionResult.reason}`
+    );
+    reference = unavailableStats(String(referenceSessionResult.reason));
+  }
+  const ci = resolveSettledStats(ciResult, "CI");
+  return {
+    reference,
+    ci,
+    referenceSession
+  };
 }
 var collectSchemaStatsActor = fromPromise(
   async ({ input }) => {
@@ -3426,43 +3965,80 @@ var collectSchemaStatsActor = fromPromise(
       ciDbUrl,
       referenceStrategy = "rebuild",
       queryProduction,
+      includeCiSemantic = false,
+      expectedDrift = [],
       tmpDir
     } = input;
     console.log(
       "[schema-stats] Collecting schema statistics (Reference/CI/Production, parallel)..."
     );
     const productionUrl = process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL;
-    const [referenceResult, productionResult] = await Promise.allSettled([
-      resolveReferenceAndCiStats({
-        repoRoot,
-        tmpDir,
-        referenceDbUrl,
-        ciDbUrl,
-        referenceStrategy
-      }),
-      collectEnvironmentStats(queryProduction ? productionUrl ?? null : null, "Production")
-    ]);
-    let local;
-    let ci;
-    if (referenceResult.status === "fulfilled") {
-      local = referenceResult.value[0];
-      ci = referenceResult.value[1];
-    } else {
-      console.warn(
-        `[schema-stats] Failed to collect reference/CI schema statistics: ${referenceResult.reason}`
-      );
-      const reason = String(referenceResult.reason);
-      local = unavailableStats(reason);
-      ci = unavailableStats(reason);
-    }
-    const production = resolveSettledProductionStats(productionResult);
-    return {
-      schemaStats: {
-        local,
-        ci,
-        production
+    const includeProductionSemantic = queryProduction;
+    let referenceSession = null;
+    try {
+      const [referenceResult, productionResult] = await Promise.allSettled([
+        resolveReferenceAndCiStats({
+          repoRoot,
+          tmpDir,
+          referenceDbUrl,
+          ciDbUrl,
+          referenceStrategy,
+          includeCiCanonical: false
+        }),
+        collectEnvironmentStats(queryProduction ? productionUrl ?? null : null, "Production")
+      ]);
+      let local;
+      let ci;
+      if (referenceResult.status === "fulfilled") {
+        local = referenceResult.value.reference;
+        ci = referenceResult.value.ci;
+        referenceSession = referenceResult.value.referenceSession;
+      } else {
+        console.warn(
+          `[schema-stats] Failed to collect reference/CI schema statistics: ${referenceResult.reason}`
+        );
+        const reason = String(referenceResult.reason);
+        local = unavailableStats(reason);
+        ci = unavailableStats(reason);
       }
-    };
+      const production = resolveSettledProductionStats(productionResult);
+      const shouldCollectProductionSemantic = includeProductionSemantic && shouldCollectProductionSemanticSnapshot({
+        reference: local,
+        production,
+        expectedDrift
+      });
+      const shouldCollectCiSemantic = includeCiSemantic && shouldCollectCiSemanticSnapshot(local, ci);
+      if (shouldCollectProductionSemantic || shouldCollectCiSemantic) {
+        console.log(
+          `[schema-stats] Deferred semantic diff collection: production=${shouldCollectProductionSemantic ? "on" : "off"} ci=${shouldCollectCiSemantic ? "on" : "off"}`
+        );
+        if (referenceStrategy === "reuse-ci") {
+          await collectCanonicalSnapshot(ci, ciDbUrl, "CI");
+          local = ci.available === false ? unavailableStats(ci.error ?? "CI database is unavailable") : cloneEnvironmentStats(ci);
+        } else if (referenceSession) {
+          await collectCanonicalSnapshot(local, referenceSession.dsn, "Reference");
+        }
+        if (shouldCollectCiSemantic && referenceStrategy !== "reuse-ci") {
+          await collectCanonicalSnapshot(ci, ciDbUrl, "CI");
+        }
+        if (shouldCollectProductionSemantic) {
+          await collectCanonicalSnapshot(production, productionUrl ?? null, "Production");
+        }
+      } else {
+        console.log(
+          "[schema-stats] Skipping semantic diff collection (basic drift already decisive)"
+        );
+      }
+      return {
+        schemaStats: {
+          local,
+          ci,
+          production
+        }
+      };
+    } finally {
+      referenceSession?.cleanup();
+    }
   }
 );
 
@@ -3587,6 +4163,9 @@ var installPgTapActor = fromPromise(
 
 // src/commands/ci/machine/actors/db/production-preview.ts
 init_esm_shims();
+var ANSI_ESCAPE_CHAR = String.fromCharCode(27);
+var ANSI_ESCAPE_PATTERN = new RegExp(`${ANSI_ESCAPE_CHAR}\\[[0-9;]*[a-zA-Z]`, "g");
+var DEFAULT_PRODUCTION_PREVIEW_TIMEOUT_MS = 10 * 6e4;
 function buildSkipResult(hasUrl) {
   return {
     preview: {
@@ -3594,12 +4173,16 @@ function buildSkipResult(hasUrl) {
       planSql: null,
       hazards: [],
       hasChanges: false,
-      error: !hasUrl ? "GH_DATABASE_URL_ADMIN / GH_DATABASE_URL not set" : null
+      error: !hasUrl ? "GH_DATABASE_URL_ADMIN not set" : null
     }
   };
 }
 function isLogMessage(line) {
   const trimmed = line.trim();
+  const statusPrefixes = ["\u2713", "\u2717", "\u26A0", "\u2139", "\u{1F4E6}", "\u2501"];
+  if (statusPrefixes.some((prefix) => trimmed.startsWith(prefix))) {
+    return true;
+  }
   const logPrefixes = [
     /^\[(?:DEBUG|INFO|WARN|ERROR|TRACE)\]/i,
     /^\d{4}-\d{2}-\d{2}/,
@@ -3607,8 +4190,6 @@ function isLogMessage(line) {
     /^(?:DEBUG|INFO|WARN|ERROR):?\s/i,
     /^▶/,
     // Our progress indicator
-    /^(?:✓|✗|⚠|ℹ️|📦|━)/,
-    // Status indicators and emojis (alternation, not character class)
     /completed in \d+/i,
     // Duration messages
     /^\s*#/,
@@ -3660,11 +4241,13 @@ function extractSqlFromLines(lines) {
   return null;
 }
 function extractSqlFromSchemaChanges(fullOutput) {
-  const schemaChangesMatch = fullOutput.match(
-    /(?:Schema changes?|Changes to apply|Plan):?\s*([\s\S]*?)(?:(?:✅|❌|Summary|$))/i
-  );
-  if (schemaChangesMatch?.[1]?.trim()) {
-    const content = schemaChangesMatch[1].trim();
+  const sectionMatch = fullOutput.match(/(?:Schema changes?|Changes to apply|Plan):?\s*/i);
+  if (sectionMatch && typeof sectionMatch.index === "number") {
+    const contentStart = sectionMatch.index + sectionMatch[0].length;
+    const sectionBody = fullOutput.slice(contentStart);
+    const boundaryMarkers = ["\n\u2705", "\n\u274C", "\nSummary"];
+    const boundaryIndexes = boundaryMarkers.map((marker) => sectionBody.indexOf(marker)).filter((index) => index >= 0);
+    const content = (boundaryIndexes.length > 0 ? sectionBody.slice(0, Math.min(...boundaryIndexes)) : sectionBody).trim();
     const lines = content.split("\n");
     const sqlLines = lines.filter(isValidSqlStatement);
     if (sqlLines.length > 0) {
@@ -3763,9 +4346,14 @@ function collectCommentHazards(lines, idempotentRoles) {
   return hazards;
 }
 function appendEmojiHazards(fullOutput, idempotentRoles, hazards) {
-  const emojiMatches = fullOutput.matchAll(/(?:🔴|🟠|🟡|⚠️)\s*(\w+):\s*(.+)/gu);
-  for (const match of emojiMatches) {
-    if (!match[1] || !match[2]) continue;
+  const hazardPrefixes = ["\u{1F534}", "\u{1F7E0}", "\u{1F7E1}", "\u26A0"];
+  for (const line of fullOutput.split("\n")) {
+    const trimmed = line.trim();
+    const matchedPrefix = hazardPrefixes.find((prefix) => trimmed.startsWith(prefix));
+    if (!matchedPrefix) continue;
+    const payload = trimmed.slice(matchedPrefix.length).trim();
+    const match = payload.match(/^(\w+):\s*(.+)$/u);
+    if (!match?.[1] || !match[2]) continue;
     const type = match[1].toUpperCase();
     const message = match[2].trim();
     if (isIdempotentRoleHazard(type, message, void 0, idempotentRoles)) {
@@ -3786,8 +4374,76 @@ function extractHazardsWithContext(fullOutput, repoRoot) {
   appendEmojiHazards(fullOutput, idempotentRoles, hazards);
   return hazards;
 }
+function stripAnsi(text) {
+  return text.replace(ANSI_ESCAPE_PATTERN, "");
+}
+function hasDisplayablePlanSql(planSql) {
+  const normalized = planSql?.trim();
+  if (!normalized) return false;
+  return normalized !== "-- No changes after filtering";
+}
+var PreviewOutputSchema = z.object({
+  success: z.boolean(),
+  planSql: z.string().optional(),
+  filteredPlanSql: z.string().optional(),
+  hazards: z.array(z.string()),
+  checkOnly: z.boolean().optional(),
+  metrics: z.object({
+    totalMs: z.number(),
+    idempotentMs: z.number().optional(),
+    applyMs: z.number().optional()
+  }).optional()
+});
+function tryParseStructuredOutput(stdout) {
+  try {
+    const trimmed = stdout.trim();
+    if (!trimmed.startsWith("{")) return null;
+    const envelope = JSON.parse(trimmed);
+    if (!envelope.ok || !envelope.data) return null;
+    const parsed = PreviewOutputSchema.safeParse(envelope.data);
+    if (!parsed.success) return null;
+    const data = parsed.data;
+    const effectivePlanSql = data.filteredPlanSql || data.planSql || null;
+    const hasChanges = hasDisplayablePlanSql(effectivePlanSql) || data.hazards.length > 0;
+    return {
+      planSql: effectivePlanSql,
+      filteredPlanSql: data.filteredPlanSql || null,
+      hazards: data.hazards,
+      hasChanges,
+      checkOnly: data.checkOnly ?? false,
+      metrics: data.metrics
+    };
+  } catch {
+    return null;
+  }
+}
+function formatDurationMs(durationMs) {
+  if (durationMs < 1e3) return `${durationMs}ms`;
+  return `${Math.round(durationMs / 100) / 10}s`;
+}
+function resolveProductionPreviewTimeoutMs() {
+  const raw = process.env.RUNA_PRODUCTION_PREVIEW_TIMEOUT_MS?.trim();
+  if (!raw) return DEFAULT_PRODUCTION_PREVIEW_TIMEOUT_MS;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return DEFAULT_PRODUCTION_PREVIEW_TIMEOUT_MS;
+  }
+  return parsed;
+}
+function startHeartbeat(label, intervalMs = 3e4) {
+  const startedAt = Date.now();
+  const timer = setInterval(() => {
+    const elapsedMs = Date.now() - startedAt;
+    console.log(`\u25B6 ${label}: still running (${formatDurationMs(elapsedMs)} elapsed)`);
+  }, intervalMs);
+  timer.unref?.();
+  return {
+    startedAt,
+    stop: () => clearInterval(timer)
+  };
+}
 function detectSchemaChangeState(fullOutput) {
-  const lowerOutput = fullOutput.toLowerCase();
+  const lowerOutput = stripAnsi(fullOutput).toLowerCase();
   const changesIndicators = [
     "check mode: schema changes detected (not applied)",
     "schema changes: detected"
@@ -3818,6 +4474,21 @@ async function writeLogFile(logFile, content) {
   } catch {
   }
 }
+async function closeLogStream(stream) {
+  await new Promise((resolve) => {
+    stream.end(() => resolve());
+  });
+}
+function normalizeStreamChunk(chunk) {
+  if (typeof chunk === "string") return chunk;
+  return Buffer.from(chunk).toString("utf8");
+}
+function normalizePreviewError(error, timeoutMs) {
+  if (error && typeof error === "object" && "timedOut" in error && error.timedOut === true) {
+    return `Production preview timed out after ${formatDurationMs(timeoutMs)}`;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
 function isNoiseLine(line) {
   const trimmed = line.trim();
   if (!trimmed) return true;
@@ -3862,17 +4533,28 @@ function buildErrorResult(error, databaseUrl) {
     }
   };
 }
-function buildPreviewFromOutput(fullOutput, repoRoot, productionUrl) {
-  const lines = fullOutput.split("\n");
-  const planSql = extractSqlFromLines(lines) || extractSqlFromSchemaChanges(fullOutput);
-  const hazardDetails = extractHazardsWithContext(fullOutput, repoRoot);
+function buildPreviewFromOutput(stdout, _stderr, fullOutput, repoRoot, productionUrl) {
+  const structured = tryParseStructuredOutput(stdout);
+  if (structured) {
+    return {
+      planSql: structured.planSql?.substring(0, 5e3) || null,
+      hazards: structured.hazards,
+      hazardDetails: void 0,
+      hasChanges: structured.hasChanges,
+      error: null
+    };
+  }
+  const cleanOutput = stripAnsi(fullOutput);
+  const lines = cleanOutput.split("\n");
+  const planSql = extractSqlFromLines(lines) || extractSqlFromSchemaChanges(cleanOutput);
+  const hazardDetails = extractHazardsWithContext(cleanOutput, repoRoot);
   const hazards = hazardDetails.map((h) => `${h.type}: ${h.message}`);
-  const schemaChangeState = detectSchemaChangeState(fullOutput);
+  const schemaChangeState = detectSchemaChangeState(cleanOutput);
   const hasSqlPlan = planSql !== null && planSql.trim().length > 0;
   const hasHazards = hazards.length > 0;
   const hasChanges = schemaChangeState === "changes" ? true : schemaChangeState === "no-changes" ? false : hasSqlPlan || hasHazards;
   const effectivePlanSql = hasChanges ? planSql?.substring(0, 5e3) || null : null;
-  const rawError = extractErrorMessage(fullOutput);
+  const rawError = extractErrorMessage(cleanOutput);
   return {
     planSql: effectivePlanSql,
     hazards,
@@ -3881,9 +4563,9 @@ function buildPreviewFromOutput(fullOutput, repoRoot, productionUrl) {
     error: enhanceConnectionError(rawError, productionUrl)
   };
 }
-function buildSuccessPreviewResult(exitCode, fullOutput, repoRoot, productionUrl) {
+function buildSuccessPreviewResult(exitCode, stdout, stderr, fullOutput, repoRoot, productionUrl) {
   const isSuccess = isCommandSuccess(exitCode, fullOutput);
-  const preview = buildPreviewFromOutput(fullOutput, repoRoot, productionUrl);
+  const preview = buildPreviewFromOutput(stdout, stderr, fullOutput, repoRoot, productionUrl);
   return {
     preview: {
       executed: true,
@@ -3898,30 +4580,85 @@ function buildSuccessPreviewResult(exitCode, fullOutput, repoRoot, productionUrl
 var productionPreviewActor = fromPromise(
   async ({ input }) => {
     const { repoRoot, tmpDir, shouldExecute } = input;
-    const productionUrl = process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL;
+    const productionUrl = process.env.GH_DATABASE_URL_ADMIN;
     if (!shouldExecute || !productionUrl) {
       return buildSkipResult(!!productionUrl);
     }
     const logFile = path4.join(tmpDir, "ci-production-preview.log");
-    console.log("\u25B6 production preview (dry-run): runa db apply production --check");
+    const timeoutMs = resolveProductionPreviewTimeoutMs();
+    console.log("\u25B6 production preview (dry-run): runa db apply production --check --compare-only");
+    console.log(
+      "\u25B6 production preview details: pg-schema-diff plan + hazard extraction (compare-only)"
+    );
+    console.log(`\u25B6 production preview timeout: ${formatDurationMs(timeoutMs)}`);
+    const heartbeat = startHeartbeat("production preview");
+    const logStream = createWriteStream(logFile, { flags: "a" });
+    const stdoutChunks = [];
+    const stderrChunks = [];
     try {
-      const result = await execa(
+      const child = execa(
         "pnpm",
-        ["exec", "runa", "db", "apply", "production", "--check", "--verbose"],
+        ["exec", "runa", "db", "apply", "production", "--check", "--compare-only"],
         {
           cwd: repoRoot,
-          env: { ...process.env, GH_DATABASE_URL_ADMIN: productionUrl },
+          env: {
+            ...process.env,
+            GH_DATABASE_URL_ADMIN: productionUrl,
+            RUNA_OUTPUT_FORMAT: "json"
+          },
+          shell: false,
+          stdio: ["ignore", "pipe", "pipe"],
+          timeout: timeoutMs,
           reject: false
         }
       );
-      const stdout = result.stdout || "";
-      const stderr = result.stderr || "";
+      child.stdout?.on("data", (chunk) => {
+        const text = normalizeStreamChunk(chunk);
+        stdoutChunks.push(text);
+        logStream.write(text);
+      });
+      child.stderr?.on("data", (chunk) => {
+        const text = normalizeStreamChunk(chunk);
+        stderrChunks.push(text);
+        process.stderr.write(text);
+        logStream.write(text);
+      });
+      const result = await child;
+      const stdout = stdoutChunks.join("");
+      const stderr = stderrChunks.join("");
       const fullOutput = `${stdout}
 ${stderr}`;
-      await writeLogFile(logFile, fullOutput);
-      return buildSuccessPreviewResult(result.exitCode, fullOutput, repoRoot, productionUrl);
+      const durationMs = Date.now() - heartbeat.startedAt;
+      heartbeat.stop();
+      await closeLogStream(logStream);
+      const structured = tryParseStructuredOutput(stdout);
+      if (structured?.metrics) {
+        console.log(
+          `\u25B6 production preview complete in ${formatDurationMs(durationMs)} (total=${formatDurationMs(structured.metrics.totalMs ?? durationMs)}, idempotent=${formatDurationMs(structured.metrics.idempotentMs ?? 0)}, diff=${formatDurationMs(structured.metrics.applyMs ?? 0)})`
+        );
+      } else {
+        console.log(`\u25B6 production preview complete in ${formatDurationMs(durationMs)}`);
+      }
+      console.log(`\u25B6 production preview log: ${logFile}`);
+      return buildSuccessPreviewResult(
+        result.exitCode,
+        stdout,
+        stderr,
+        fullOutput,
+        repoRoot,
+        productionUrl
+      );
     } catch (error) {
-      return buildErrorResult(error, productionUrl);
+      heartbeat.stop();
+      const stdout = stdoutChunks.join("");
+      const stderr = stderrChunks.join("");
+      const fullOutput = `${stdout}
+${stderr}`.trim();
+      await closeLogStream(logStream);
+      if (fullOutput) {
+        await writeLogFile(logFile, fullOutput);
+      }
+      return buildErrorResult(normalizePreviewError(error, timeoutMs), productionUrl);
     }
   }
 );
@@ -4246,56 +4983,84 @@ function analyzePostCheckResult(params) {
     commandFailed: !checkSucceeded
   };
 }
+function createSyncCommandArgs(params) {
+  if (params.useDbApply) {
+    return [
+      "exec",
+      "runa",
+      "db",
+      "apply",
+      params.envArg,
+      "--auto-approve",
+      "--no-seed",
+      "--verbose"
+    ];
+  }
+  return [
+    "exec",
+    "runa",
+    "db",
+    "sync",
+    params.envArg,
+    "--auto-approve",
+    "--verbose",
+    ...params.skipCodegen ? ["--skip-codegen"] : []
+  ];
+}
+function createCheckCommandArgs(params) {
+  if (params.useDbApply) {
+    return ["exec", "runa", "db", "apply", params.envArg, "--check", "--no-seed", "--verbose"];
+  }
+  return [
+    "exec",
+    "runa",
+    "db",
+    "sync",
+    params.envArg,
+    "--check",
+    "--verbose",
+    ...params.skipCodegen ? ["--skip-codegen"] : []
+  ];
+}
+function readOptionalLogContent(filePath) {
+  try {
+    return readFileSync(filePath, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function createSchemaDriftSnapshot(params) {
+  return {
+    beforeSql: params.logContent.substring(0, 5e3),
+    afterSql: params.postCheckHasDrift ? params.afterCheckLogContent.substring(0, 5e3) : "",
+    checkExecuted: params.checkExecuted,
+    hasDrift: params.postCheckHasDrift,
+    changeStats: params.changeStats,
+    gitDiff: params.gitDiff,
+    logs: {
+      beforeCheckLogPath: params.logFile,
+      applyLogPath: params.logFile,
+      afterCheckLogPath: params.afterCheckLogFile
+    }
+  };
+}
 var syncSchemaActor = fromPromise(
   async ({ input }) => {
-    const { repoRoot, tmpDir, databaseUrl, mode, skipCodegen } = input;
+    const { repoRoot, tmpDir, databaseUrl, mode, skipCodegen, skipPostCheck = false } = input;
     const envArg = mode === "ci-local" ? "local" : "preview";
     const useDbApply = mode !== "ci-local";
     const gitDiff = getSchemaGitDiff(repoRoot);
+    const syncArgs = createSyncCommandArgs({ useDbApply, envArg, skipCodegen });
+    const checkArgs = createCheckCommandArgs({ useDbApply, envArg, skipCodegen });
+    const logFile = path4.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
+    const afterCheckLogFile = path4.join(tmpDir, `ci-db-check-${envArg}.log`);
     try {
       const databaseUrlForRuntime = normalizeDatabaseUrlForDdl(databaseUrl);
       const baseEnv = {
         ...process.env,
-        // Runtime (app/tests): session pooler + IPv4 where needed
         DATABASE_URL: databaseUrlForRuntime,
-        // Schema ops (DDL): keep raw/admin URL if provided
         DATABASE_URL_ADMIN: databaseUrl
       };
-      const syncArgs = useDbApply ? [
-        "exec",
-        "runa",
-        "db",
-        "apply",
-        envArg,
-        "--auto-approve",
-        // Allow DELETES_DATA hazards in preview
-        "--no-seed",
-        // Seeds applied separately by applySeedsActor
-        "--verbose"
-        // Always verbose for full traceability
-      ] : [
-        "exec",
-        "runa",
-        "db",
-        "sync",
-        envArg,
-        "--auto-approve",
-        "--verbose",
-        // Always verbose for full traceability
-        ...skipCodegen ? ["--skip-codegen"] : []
-      ];
-      const checkArgs = useDbApply ? ["exec", "runa", "db", "apply", envArg, "--check", "--no-seed", "--verbose"] : [
-        "exec",
-        "runa",
-        "db",
-        "sync",
-        envArg,
-        "--check",
-        "--verbose",
-        ...skipCodegen ? ["--skip-codegen"] : []
-      ];
-      const logFile = path4.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
-      const afterCheckLogFile = path4.join(tmpDir, `ci-db-check-${envArg}.log`);
       await runLogged({
         cwd: repoRoot,
         env: baseEnv,
@@ -4304,6 +5069,21 @@ var syncSchemaActor = fromPromise(
         args: syncArgs,
         logFile
       });
+      const logContent = readOptionalLogContent(logFile);
+      const changeStats = parseSchemaChangeStats(logContent, null, repoRoot);
+      if (skipPostCheck) {
+        const schemaDrift2 = createSchemaDriftSnapshot({
+          logContent,
+          afterCheckLogContent: "",
+          postCheckHasDrift: false,
+          checkExecuted: false,
+          changeStats,
+          gitDiff,
+          logFile,
+          afterCheckLogFile
+        });
+        return { applied: true, schemaDrift: schemaDrift2 };
+      }
       const postCheckResult = await runLogged({
         cwd: repoRoot,
         env: baseEnv,
@@ -4313,17 +5093,7 @@ var syncSchemaActor = fromPromise(
         logFile: afterCheckLogFile,
         reject: false
       });
-      let logContent = "";
-      let afterCheckLogContent = "";
-      try {
-        logContent = readFileSync(logFile, "utf-8");
-      } catch {
-      }
-      try {
-        afterCheckLogContent = readFileSync(afterCheckLogFile, "utf-8");
-      } catch {
-      }
-      const changeStats = parseSchemaChangeStats(logContent, null, repoRoot);
+      const afterCheckLogContent = readOptionalLogContent(afterCheckLogFile);
       const residualStats = parseSchemaChangeStats(afterCheckLogContent, null, repoRoot);
       const fullPostCheckOutput = `${postCheckResult.stdout || ""}
 ${postCheckResult.stderr || ""}`;
@@ -4340,20 +5110,16 @@ ${postCheckResult.stderr || ""}`;
           )}`
         );
       }
-      const schemaDrift = {
-        beforeSql: logContent.substring(0, 5e3),
-        // Truncate for comment
-        afterSql: postCheckAnalysis.hasDrift ? afterCheckLogContent.substring(0, 5e3) : "",
+      const schemaDrift = createSchemaDriftSnapshot({
+        logContent,
+        afterCheckLogContent,
+        postCheckHasDrift: postCheckAnalysis.hasDrift,
         checkExecuted: true,
-        hasDrift: postCheckAnalysis.hasDrift,
         changeStats,
         gitDiff,
-        logs: {
-          beforeCheckLogPath: logFile,
-          applyLogPath: logFile,
-          afterCheckLogPath: afterCheckLogFile
-        }
-      };
+        logFile,
+        afterCheckLogFile
+      });
       return { applied: true, schemaDrift };
     } catch (error) {
       const schemaDrift = {
@@ -4433,23 +5199,6 @@ fromPromise(
   }
 );
 
-// src/commands/ci/machine/actors/finalize/summary.ts
-init_esm_shims();
-var writeSummaryActor = fromPromise(
-  async ({ input }) => {
-    const { cwd, summary } = input;
-    try {
-      const filePath = await writeCiSummary({ cwd, summary });
-      return { filePath };
-    } catch (error) {
-      return {
-        filePath: "",
-        error: error instanceof Error ? error.message : String(error)
-      };
-    }
-  }
-);
-
 // src/commands/ci/machine/actors/setup/index.ts
 init_esm_shims();
 
@@ -4459,6 +5208,7 @@ init_esm_shims();
 // src/commands/ci/commands/ci-supabase-local.ts
 init_esm_shims();
 init_constants();
+init_local_supabase();
 function isPortAvailable(port) {
   return new Promise((resolve) => {
     const server = net.createServer();
@@ -4485,9 +5235,9 @@ function detectSupabaseContainers() {
 async function checkSupabasePortConflicts(repoRoot) {
   let dbPort = 54322;
   try {
-    const { readFileSync: readFileSync4 } = await import('fs');
+    const { readFileSync: readFileSync5 } = await import('fs');
     const configPath = path4.join(repoRoot, "supabase", "config.toml");
-    const content = readFileSync4(configPath, "utf-8");
+    const content = readFileSync5(configPath, "utf-8");
     const match = /\[db\][^[]*?port\s*=\s*(\d+)/s.exec(content);
     if (match?.[1]) dbPort = Number.parseInt(match[1], 10);
   } catch {
@@ -4519,6 +5269,10 @@ async function checkSupabasePortConflicts(repoRoot) {
   console.warn("");
 }
 async function startSupabaseLocal(params) {
+  if (params.skipStart) {
+    console.log("\u2139\uFE0F  Skipping local Supabase start (assumed ready by caller)");
+    return;
+  }
   await checkSupabasePortConflicts(params.repoRoot);
   const exclude = process.env.RUNA_CI_SUPABASE_EXCLUDE ?? "studio,edge-runtime,storage-api,realtime,imgproxy,mailpit,logflare,vector,supavisor";
   await runLogged({
@@ -4531,13 +5285,17 @@ async function startSupabaseLocal(params) {
   });
 }
 function getDefaultLocalSupabaseUrl(repoRoot) {
-  const ports = detectSupabasePorts(repoRoot);
-  return `http://127.0.0.1:${ports.api}`;
+  const ports = detectLocalSupabasePorts(repoRoot);
+  return `http://${ports.host}:${ports.api}`;
+}
+function getConfiguredLocalSupabaseUrl(repoRoot) {
+  const ports = detectLocalSupabasePorts(repoRoot, { skipStatusDetection: true });
+  return `http://${ports.host}:${ports.api}`;
 }
 function getDefaultLocalDatabaseUrl(repoRoot) {
   try {
-    const ports = detectSupabasePorts(repoRoot);
-    return `postgresql://postgres:postgres@127.0.0.1:${ports.db}/postgres`;
+    const ports = detectLocalSupabasePorts(repoRoot);
+    return `postgresql://postgres:postgres@${ports.host}:${ports.db}/postgres`;
   } catch {
     console.warn("\u26A0\uFE0F Could not detect Supabase ports, using default port 54322");
     return "postgresql://postgres:postgres@127.0.0.1:54322/postgres";
@@ -4545,9 +5303,32 @@ function getDefaultLocalDatabaseUrl(repoRoot) {
 }
 var DEFAULT_LOCAL_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0";
 async function resolveLocalSupabaseEnv(params) {
-  const maxRetries = parseIntOr(process.env.RUNA_CI_SUPABASE_STATUS_RETRIES, 20);
-  const sleepSeconds = parseIntOr(process.env.RUNA_CI_SUPABASE_STATUS_SLEEP_SECONDS, 3);
+  const maxRetries = Math.max(1, parseIntOr(process.env.RUNA_CI_SUPABASE_STATUS_RETRIES, 20));
+  const sleepSeconds = Math.max(
+    0,
+    parseIntOr(process.env.RUNA_CI_SUPABASE_STATUS_SLEEP_SECONDS, 3)
+  );
+  if (params.assumeReady) {
+    console.log("\u2139\uFE0F  Reusing pre-started local Supabase connection (assume-ready)");
+    return {
+      supabaseUrl: getConfiguredLocalSupabaseUrl(params.repoRoot),
+      anonKey: DEFAULT_LOCAL_ANON_KEY,
+      diagnostics: {
+        strategy: "assume-ready",
+        finalSource: "assumed-local-config",
+        attempts: 0,
+        maxAttempts: maxRetries,
+        sleepSeconds,
+        waitedMs: 0
+      }
+    };
+  }
+  console.log(
+    `\u2139\uFE0F  Resolving local Supabase connection via status polling (maxRetries=${maxRetries}, interval=${sleepSeconds}s)`
+  );
+  let lastError;
   for (let i = 0; i < maxRetries; i++) {
+    const attempt = i + 1;
     try {
       const res = await runLogged({
         cwd: params.repoRoot,
@@ -4557,7 +5338,9 @@ async function resolveLocalSupabaseEnv(params) {
         args: ["status", "--output", "json"],
         logFile: path4.join(params.tmpDir, `supabase-status-${i + 1}.log`)
       });
-      const parsed = JSON.parse(String(res.stdout ?? "{}"));
+      const rawStdout = String(res.stdout ?? "{}");
+      const jsonMatch = rawStdout.match(/\{[\s\S]*\}/);
+      const parsed = JSON.parse(jsonMatch?.[0] ?? "{}");
       const out = z.object({
         API_URL: z.string().optional(),
         PUBLISHABLE_KEY: z.string().min(1).optional(),
@@ -4565,17 +5348,51 @@ async function resolveLocalSupabaseEnv(params) {
       }).passthrough().parse(parsed);
       const supabaseUrl = out.API_URL || getDefaultLocalSupabaseUrl(params.repoRoot);
       const anonKey = out.PUBLISHABLE_KEY ?? out.ANON_KEY ?? DEFAULT_LOCAL_ANON_KEY;
-      return { supabaseUrl, anonKey };
-    } catch {
+      const waitedMs = i * sleepSeconds * 1e3;
+      console.log(
+        `\u2139\uFE0F  Supabase status resolved after ${attempt} attempt${attempt === 1 ? "" : "s"} (waited ${Math.round(waitedMs / 1e3)}s)`
+      );
+      return {
+        supabaseUrl,
+        anonKey,
+        diagnostics: {
+          strategy: "status-polling",
+          finalSource: "status-json",
+          attempts: attempt,
+          maxAttempts: maxRetries,
+          sleepSeconds,
+          waitedMs,
+          lastError
+        }
+      };
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+      if (attempt < maxRetries) {
+        console.log(
+          `\u2139\uFE0F  Supabase status not ready (attempt ${attempt}/${maxRetries}); waiting ${sleepSeconds}s before retry`
+        );
+      }
+    }
+    if (attempt < maxRetries) {
+      await new Promise((r) => setTimeout(r, sleepSeconds * 1e3));
     }
-    await new Promise((r) => setTimeout(r, sleepSeconds * 1e3));
   }
   console.warn(
     "\u26A0\uFE0F Failed to resolve Supabase status after retries, using hardcoded local values. CI uses direct PostgreSQL, so this is non-blocking."
   );
   return {
-    supabaseUrl: "http://127.0.0.1:54321",
-    anonKey: DEFAULT_LOCAL_ANON_KEY
+    supabaseUrl: getConfiguredLocalSupabaseUrl(params.repoRoot),
+    anonKey: DEFAULT_LOCAL_ANON_KEY,
+    diagnostics: {
+      strategy: "fallback-default",
+      finalSource: "default-fallback",
+      attempts: maxRetries,
+      maxAttempts: maxRetries,
+      sleepSeconds,
+      waitedMs: Math.max(0, maxRetries - 1) * sleepSeconds * 1e3,
+      retriesExhausted: true,
+      lastError
+    }
   };
 }
 
@@ -4606,7 +5423,12 @@ var localSetupActor = fromPromise(
         productionUrl,
         supabaseUrl: supabaseInfo.supabaseUrl,
         anonKey: supabaseInfo.anonKey,
-        layers
+        layers,
+        diagnostics: {
+          setup: {
+            supabase: supabaseInfo.diagnostics
+          }
+        }
       };
     } catch (error) {
       return {
@@ -4617,6 +5439,7 @@ var localSetupActor = fromPromise(
         supabaseUrl: "",
         anonKey: "",
         layers: [],
+        diagnostics: {},
         error: error instanceof Error ? error.message : String(error)
       };
     }
@@ -4625,25 +5448,160 @@ var localSetupActor = fromPromise(
 
 // src/commands/ci/machine/actors/setup/pr-local.ts
 init_esm_shims();
+
+// src/commands/ci/machine/helpers.ts
+init_esm_shims();
+var CORE_LAYERS = [1, 2, 3];
+var E2E_LAYER = 4;
+function getLayersForCorePhase(selectedLayers, mode) {
+  if (mode === "ci-local") {
+    return selectedLayers;
+  }
+  return selectedLayers.filter((l) => CORE_LAYERS.includes(l));
+}
+function hasE2ELayer(selectedLayers) {
+  return selectedLayers.includes(E2E_LAYER);
+}
+function getRuntimeOwner(context) {
+  return context.input.skipLocalDbStart === true || context.input.assumeSupabaseReady === true || context.diagnostics.setup?.runtimeOwner === "external" || context.diagnostics.setup?.supabase?.strategy === "assume-ready" ? "external" : "sdk";
+}
+function shouldReusePreparedRuntime(context) {
+  return getRuntimeOwner(context) === "external";
+}
+function getPlaywrightOwner(context) {
+  return context.input.skipPlaywrightInstall === true || context.diagnostics.setup?.playwrightOwner === "external" ? "external" : "sdk";
+}
+function shouldReusePreparedPlaywright(context) {
+  return getPlaywrightOwner(context) === "external";
+}
+function hasSchemaGitChanges(context) {
+  return (context.schemaDrift?.gitDiff?.filesChanged.length ?? 0) > 0;
+}
+function shouldSkipSchemaPostCheck(context) {
+  return context.mode === "ci-pr-local" && context.executionEnv === "github-actions";
+}
+function shouldReuseCiReferenceStats(context) {
+  return context.mode !== "ci-local" && context.schemaApplied && context.schemaDrift !== null && context.schemaDrift?.hasDrift === false;
+}
+function mergeLayerResults(coreResults, e2eResults) {
+  return { ...coreResults, ...e2eResults };
+}
+function convertLayerResults(results) {
+  const layerResults = {};
+  for (const r of results) {
+    let status;
+    if (r.killed) {
+      status = "killed";
+    } else if (r.skipped) {
+      status = "skipped";
+    } else {
+      status = r.success ? "passed" : "failed";
+    }
+    layerResults[r.layer] = {
+      status,
+      exitCode: r.exitCode,
+      // Preserve test count information
+      passed: r.passedTests,
+      total: r.totalTests,
+      failed: r.failedTests,
+      flaky: r.flakyTests
+    };
+  }
+  return layerResults;
+}
+function getDatabaseUrlForRuntime(context) {
+  const raw = context.supabase?.appDatabaseUrl ?? context.supabase?.databaseUrlRaw ?? "";
+  return normalizeDatabaseUrlForDdl(raw);
+}
+function getSupabaseUrlWithFallback(context) {
+  return context.supabase?.supabaseUrl || getDefaultLocalSupabaseUrl(context.repoRoot ?? void 0);
+}
+function getSupabaseAnonKeyWithFallback(context) {
+  return context.supabase?.anonKey || DEFAULT_LOCAL_ANON_KEY;
+}
+function buildRuntimeEnv(context, options = {}) {
+  const env = {
+    ...context.input.runtimeEnv ?? {},
+    DATABASE_URL: getDatabaseUrlForRuntime(context),
+    NEXT_PUBLIC_SUPABASE_URL: getSupabaseUrlWithFallback(context),
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: getSupabaseAnonKeyWithFallback(context)
+  };
+  if (options.enablePublicE2EFlag) {
+    env.NEXT_PUBLIC_E2E_TEST = "true";
+  }
+  if (options.enableServerE2EFlag) {
+    env.E2E_TEST = "true";
+  }
+  if (options.baseUrl) {
+    env.BASE_URL = options.baseUrl;
+  }
+  return env;
+}
+function computeExitCodeFromLayerResults(layerResults) {
+  const classification = getClassificationForProfile("runa-strict");
+  const classificationMap = new Map(classification.map((c) => [c.layer, c.level]));
+  let hasBlockingFailure = false;
+  let hasWarningFailure = false;
+  for (const [layerStr, result] of Object.entries(layerResults)) {
+    const layer = Number.parseInt(layerStr, 10);
+    if (Number.isNaN(layer)) continue;
+    const isFailed = result.status !== "passed" && result.status !== "skipped";
+    if (!isFailed) continue;
+    const level = classificationMap.get(layer) ?? "blocking";
+    if (level === "blocking") {
+      hasBlockingFailure = true;
+    } else {
+      hasWarningFailure = true;
+    }
+  }
+  if (hasBlockingFailure) return 1;
+  if (hasWarningFailure) return 2;
+  return 0;
+}
+
+// src/commands/ci/machine/actors/setup/pr-local.ts
 var prLocalSetupActor = fromPromise(
   async ({ input }) => {
     const repoRoot = input.targetDir || process.cwd();
     try {
       const base = await executePrSetupBase(input, ensureRunaTmpDir);
+      const ownershipContext = {
+        input: {
+          command: "pr",
+          ...input,
+          ...base,
+          skipLocalDbStart: input.skipLocalDbStart,
+          assumeSupabaseReady: input.assumeSupabaseReady,
+          skipPlaywrightInstall: input.skipPlaywrightInstall
+        },
+        diagnostics: {}
+      };
       try {
-        await startSupabaseLocal({ repoRoot: base.repoRoot, tmpDir: base.tmpDir });
+        await startSupabaseLocal({
+          repoRoot: base.repoRoot,
+          tmpDir: base.tmpDir,
+          skipStart: input.skipLocalDbStart || input.assumeSupabaseReady
+        });
       } catch {
       }
       const supabaseInfo = await resolveLocalSupabaseEnv({
         repoRoot: base.repoRoot,
-        tmpDir: base.tmpDir
+        tmpDir: base.tmpDir,
+        assumeReady: input.assumeSupabaseReady
       });
       const databaseUrl = input.databaseUrl || getDefaultLocalDatabaseUrl(base.repoRoot);
       return {
         ...base,
         databaseUrl,
         supabaseUrl: supabaseInfo.supabaseUrl,
-        anonKey: supabaseInfo.anonKey
+        anonKey: supabaseInfo.anonKey,
+        diagnostics: {
+          setup: {
+            runtimeOwner: getRuntimeOwner(ownershipContext),
+            playwrightOwner: getPlaywrightOwner(ownershipContext),
+            supabase: supabaseInfo.diagnostics
+          }
+        }
       };
     } catch (error) {
       return createErrorOutput(repoRoot, error);
@@ -5605,6 +6563,15 @@ async function waitUntilAllFinished(params) {
   const timeoutId = setTimeout(() => {
     abortController.abort();
   }, maxWaitMs);
+  const progressIntervalMs = Math.max(1, params.progressIntervalSeconds) * 1e3;
+  const progressStartedAt = Date.now();
+  const progressTimer = setInterval(() => {
+    if (remaining.size === 0) return;
+    const runningLayers = Array.from(remaining).map((p) => `L${p.layer}`).sort().join(", ");
+    const elapsedSeconds = Math.round((Date.now() - progressStartedAt) / 1e3);
+    console.log(`[Progress] Tests still running after ${elapsedSeconds}s: ${runningLayers}`);
+  }, progressIntervalMs);
+  progressTimer.unref?.();
   try {
     while (remaining.size > 0) {
       if (abortController.signal.aborted) {
@@ -5650,6 +6617,7 @@ async function waitUntilAllFinished(params) {
     }
   } finally {
     clearTimeout(timeoutId);
+    clearInterval(progressTimer);
   }
   return { successMap };
 }
@@ -5803,7 +6771,7 @@ var SKIP_CONFIGS = {
   staticChecks: { skipInCiLocal: true, inputFlag: "skipStaticChecks" },
   build: { skipInCiLocal: true, inputFlag: "skipBuild" },
   appStart: { skipInCiLocal: true, requiresLayer: 4 },
-  playwrightInstall: { skipInCiLocal: true, requiresLayer: 4 }
+  playwrightInstall: { skipInCiLocal: true, inputFlag: "skipPlaywrightInstall", requiresLayer: 4 }
 };
 function shouldSkipStep(context, key) {
   const config = SKIP_CONFIGS[key];
@@ -5844,6 +6812,9 @@ function shouldPostGitHubComment(context) {
   if (context.input.skipGithubComment === true) return false;
   return true;
 }
+function isTestPhase(context) {
+  return isCiPrMode(context) && context.input.phase === "test";
+}
 function hasError(context) {
   return context.error !== null;
 }
@@ -5858,127 +6829,45 @@ function isDryRun(context) {
   return context.input.check === true;
 }
 
-// src/commands/ci/machine/helpers.ts
-init_esm_shims();
-var CORE_LAYERS = [1, 2, 3];
-var E2E_LAYER = 4;
-function getLayersForCorePhase(selectedLayers, mode) {
-  if (mode === "ci-local") {
-    return selectedLayers;
-  }
-  return selectedLayers.filter((l) => CORE_LAYERS.includes(l));
-}
-function hasE2ELayer(selectedLayers) {
-  return selectedLayers.includes(E2E_LAYER);
-}
-function shouldReuseCiReferenceStats(context) {
-  return context.mode !== "ci-local" && context.schemaApplied && context.schemaDrift !== null && context.schemaDrift?.hasDrift === false;
-}
-function mergeLayerResults(coreResults, e2eResults) {
-  return { ...coreResults, ...e2eResults };
-}
-function convertLayerResults(results) {
-  const layerResults = {};
-  for (const r of results) {
-    let status;
-    if (r.killed) {
-      status = "killed";
-    } else if (r.skipped) {
-      status = "skipped";
-    } else {
-      status = r.success ? "passed" : "failed";
-    }
-    layerResults[r.layer] = {
-      status,
-      exitCode: r.exitCode,
-      // Preserve test count information
-      passed: r.passedTests,
-      total: r.totalTests,
-      failed: r.failedTests,
-      flaky: r.flakyTests
-    };
-  }
-  return layerResults;
-}
-function getDatabaseUrlForRuntime(context) {
-  const raw = context.supabase?.appDatabaseUrl ?? context.supabase?.databaseUrlRaw ?? "";
-  return normalizeDatabaseUrlForDdl(raw);
-}
-function getSupabaseUrlWithFallback(context) {
-  return context.supabase?.supabaseUrl || getDefaultLocalSupabaseUrl(context.repoRoot ?? void 0);
-}
-function getSupabaseAnonKeyWithFallback(context) {
-  return context.supabase?.anonKey || DEFAULT_LOCAL_ANON_KEY;
-}
-function buildRuntimeEnv(context, options = {}) {
-  const env = {
-    ...context.input.runtimeEnv ?? {},
-    DATABASE_URL: getDatabaseUrlForRuntime(context),
-    NEXT_PUBLIC_SUPABASE_URL: getSupabaseUrlWithFallback(context),
-    NEXT_PUBLIC_SUPABASE_ANON_KEY: getSupabaseAnonKeyWithFallback(context)
-  };
-  if (options.enablePublicE2EFlag) {
-    env.NEXT_PUBLIC_E2E_TEST = "true";
-  }
-  if (options.enableServerE2EFlag) {
-    env.E2E_TEST = "true";
-  }
-  if (options.baseUrl) {
-    env.BASE_URL = options.baseUrl;
-  }
-  return env;
-}
-function computeExitCodeFromLayerResults(layerResults) {
-  const classification = getClassificationForProfile("runa-strict");
-  const classificationMap = new Map(classification.map((c) => [c.layer, c.level]));
-  let hasBlockingFailure = false;
-  let hasWarningFailure = false;
-  for (const [layerStr, result] of Object.entries(layerResults)) {
-    const layer = Number.parseInt(layerStr, 10);
-    if (Number.isNaN(layer)) continue;
-    const isFailed = result.status !== "passed" && result.status !== "skipped";
-    if (!isFailed) continue;
-    const level = classificationMap.get(layer) ?? "blocking";
-    if (level === "blocking") {
-      hasBlockingFailure = true;
-    } else {
-      hasWarningFailure = true;
-    }
-  }
-  if (hasBlockingFailure) return 1;
-  if (hasWarningFailure) return 2;
-  return 0;
-}
-
 // src/commands/ci/machine/machine-state-helpers.ts
 init_esm_shims();
 
 // src/commands/ci/machine/formatters/github-comment.ts
 init_esm_shims();
 
-// src/commands/ci/machine/formatters/sections/index.ts
-init_esm_shims();
-
-// src/commands/ci/machine/formatters/sections/final-comment.ts
-init_esm_shims();
-
-// src/commands/ci/machine/formatters/sections/format-helpers.ts
-init_esm_shims();
-
 // src/commands/ci/machine/formatters/github-comment-types.ts
 init_esm_shims();
 var CI_STEPS = [
   { step: "setup", label: "\u74B0\u5883\u30BB\u30C3\u30C8\u30A2\u30C3\u30D7", detail: "\u30EA\u30DD\u30B8\u30C8\u30EA\u691C\u51FA\u3001Supabase\u8D77\u52D5" },
   { step: "syncSchema", label: "\u30B9\u30AD\u30FC\u30DE\u540C\u671F", detail: "pg-schema-diff \u2192 CI DB" },
   { step: "applySeeds", label: "\u30B7\u30FC\u30C9\u9069\u7528", detail: "ci.sql + prerequisite seeds" },
+  {
+    step: "postSeedChecks",
+    label: "\u30ED\u30FC\u30EB\u6E96\u5099",
+    detail: "db roles setup"
+  },
+  {
+    step: "observability",
+    label: "\u672C\u756A\u6BD4\u8F03\u30FBschema stats",
+    detail: "production preview \u2225 schema stats"
+  },
   { step: "staticChecks", label: "\u9759\u7684\u30C1\u30A7\u30C3\u30AF", detail: "\u578B\u30C1\u30A7\u30C3\u30AF \u2225 lint" },
   { step: "build", label: "\u30D3\u30EB\u30C9", detail: "build \u2225 playwright install" },
   { step: "runTests", label: "\u30C6\u30B9\u30C8\u5B9F\u884C", detail: "L0-L3 (\u30D6\u30ED\u30C3\u30AD\u30F3\u30B0) \u2192 L4 (E2E)" },
   { step: "finalize", label: "\u5B8C\u4E86\u51E6\u7406", detail: "\u30B5\u30DE\u30EA\u30FC + PR\u30B3\u30E1\u30F3\u30C8" }
 ];
 var BLOCKING_LAYERS = [0, 1, 2, 3];
+var CI_OBSERVABILITY_SECTION_START_MARKER = "<!-- runa-ci-observability:start -->";
+var CI_OBSERVABILITY_SECTION_END_MARKER = "<!-- runa-ci-observability:end -->";
+
+// src/commands/ci/machine/formatters/sections/index.ts
+init_esm_shims();
+
+// src/commands/ci/machine/formatters/sections/final-comment.ts
+init_esm_shims();
 
 // src/commands/ci/machine/formatters/sections/format-helpers.ts
+init_esm_shims();
 function formatDuration4(ms) {
   if (ms < 1e3) return `${ms}ms`;
   const seconds = Math.floor(ms / 1e3);
@@ -6441,7 +7330,20 @@ function describeObject(object) {
       return `function \`${object.label}\``;
     case "table":
       return `table \`${object.label}\``;
-  }
+    case "schema_acl":
+      return `schema ACL \`${object.label}\``;
+    case "schema_comment":
+      return `schema comment \`${object.label}\``;
+    case "table_acl":
+      return `table ACL \`${object.label}\``;
+    case "table_comment":
+      return `table comment \`${object.label}\``;
+    case "function_acl":
+      return `function ACL \`${object.label}\``;
+    case "function_comment":
+      return `function comment \`${object.label}\``;
+  }
+  return `object \`${object.label}\``;
 }
 function appendObjectLines(lines, prefix, objects, label) {
   if (objects.length === 0) return;
@@ -6740,7 +7642,7 @@ function generatePreviewChangesDetectedSection(prodPreview, previewOnlyChanges)
   if (previewOnlyChanges) {
     lines.push(
       "> \u88DC\u8DB3: `Prod semantic diff` / count diff / index diff \u3067\u306F\u5DEE\u5206\u304C\u306A\u304F\u3001`production --check` \u306E\u307F\u304C\u5909\u66F4\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\u3002",
-      "> \u3053\u308C\u306F grants / ACL / ownership \u306A\u3069 canonical semantic diff \u306E\u5BFE\u8C61\u5916\u5DEE\u5206\u3067\u3042\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002",
+      "> \u3053\u308C\u306F ownership / session config / planner-only rewrite \u306A\u3069\u3001canonical diff \u3067\u306F\u8FFD\u308F\u306A\u3044\u5DEE\u5206\u3067\u3042\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002",
       ""
     );
   }
@@ -6754,8 +7656,13 @@ function buildComparisonMismatchReasons(schemaStats, expectedDrift) {
   const reasons = [];
   if (signals.hasSemanticChanges && signals.semanticDiff) {
     const diff = signals.semanticDiff;
+    const classification = classifyCanonicalDiff(diff);
+    const families = [];
+    if (classification.structural) families.push("structural");
+    if (classification.securityMetadata) families.push("security-metadata");
+    if (classification.descriptiveMetadata) families.push("descriptive-metadata");
     reasons.push(
-      `semantic diff: changed ${diff.changed.length}, missing ${diff.missing.length}, extra ${diff.extra.length}, renamed ${diff.renamed.length}`
+      `semantic diff (${families.join(", ")}): changed ${diff.changed.length}, missing ${diff.missing.length}, extra ${diff.extra.length}, renamed ${diff.renamed.length}`
     );
   }
   if (signals.hasIndexChanges && signals.indexDiff) {
@@ -6804,7 +7711,7 @@ function generateKnownDriftOnlySection(schemaStats, expectedDrift) {
   lines.push("");
   return lines;
 }
-function generateProductionPreviewSection(prodPreview, schemaDrift, schemaStats, expectedDrift) {
+function generateProductionPreviewSection(phase, prodPreview, schemaDrift, schemaStats, expectedDrift) {
   const signals = getProductionSchemaSignals(prodPreview, schemaStats, expectedDrift);
   if (!prodPreview?.executed) {
     if (schemaDrift?.gitDiff?.filesChanged?.length) {
@@ -6835,7 +7742,7 @@ function shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges
   if (!productionPreview?.executed && schemaDrift?.gitDiff?.filesChanged?.length) return true;
   return false;
 }
-function generateDeploySection(exitCode, layerResults, gitBranchName, productionPreview, schemaDrift, schemaStats, expectedDrift, env) {
+function generateDeploySection(exitCode, layerResults, phase, gitBranchName, productionPreview, schemaDrift, schemaStats, expectedDrift, env) {
   if (!checkIfDeployable(exitCode, layerResults)) return [];
   const deployWorkflowUrl = env.repository ? `${env.serverUrl}/${env.repository}/actions/workflows/deploy-db.yml` : null;
   const signals = getProductionSchemaSignals(productionPreview, schemaStats, expectedDrift);
@@ -6846,7 +7753,13 @@ function generateDeploySection(exitCode, layerResults, gitBranchName, production
   if (exitCode !== 0)
     lines.push("> **\u6CE8**: Layer 4 (E2E) \u306F\u5931\u6557\u3057\u307E\u3057\u305F\u304C\u3001\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u306F\u30C7\u30D7\u30ED\u30A4\u53EF\u80FD\u3067\u3059\u3002", "");
   lines.push(
-    ...generateProductionPreviewSection(productionPreview, schemaDrift, schemaStats, expectedDrift)
+    ...generateProductionPreviewSection(
+      phase,
+      productionPreview,
+      schemaDrift,
+      schemaStats,
+      expectedDrift
+    )
   );
   const showButton = shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges2);
   if (deployWorkflowUrl && showButton) {
@@ -6862,6 +7775,37 @@ function generateDeploySection(exitCode, layerResults, gitBranchName, production
   }
   return lines;
 }
+function generateObservabilitySectionBody(input) {
+  const env = getGitHubEnv();
+  const gitBranchName = input.prContext?.headBranch ?? input.branchName ?? "unknown";
+  const lines = [
+    ...formatSchemaMatrix(
+      input.schemaStats,
+      input.schemaDrift?.gitDiff ?? null,
+      input.expectedDrift ?? []
+    ),
+    ...generateDeploySection(
+      input.exitCode,
+      input.layerResults,
+      input.phase,
+      gitBranchName,
+      input.productionPreview,
+      input.schemaDrift,
+      input.schemaStats ?? null,
+      input.expectedDrift ?? [],
+      env
+    )
+  ];
+  return lines.join("\n").trim();
+}
+function wrapObservabilitySection(sectionBody) {
+  return [
+    CI_OBSERVABILITY_SECTION_START_MARKER,
+    sectionBody,
+    CI_OBSERVABILITY_SECTION_END_MARKER,
+    ""
+  ];
+}
 function generateIntermediateCommentBody(input) {
   const { branchName, layerResults, intermediateMessage, productionPreview, schemaDrift } = input;
   const env = getGitHubEnv();
@@ -6883,6 +7827,7 @@ function generateIntermediateCommentBody(input) {
     ...generateDeploySection(
       intermediateExitCode,
       layerResults,
+      input.phase,
       gitBranchName,
       productionPreview,
       schemaDrift,
@@ -6903,29 +7848,14 @@ function generateCommentBody(input) {
   const runUrl = env.repository && env.runId ? `${env.serverUrl}/${env.repository}/actions/runs/${env.runId}` : null;
   const effectiveBranchName = branchName ?? input.prContext?.headBranch ?? "unknown";
   const supabaseUrl = supabase?.supabaseUrl ?? "";
-  const gitBranchName = input.prContext?.headBranch ?? branchName ?? "unknown";
   const layerLines = formatLayerResults(layerResults);
   const skippedLayersLines = input.layerSkipReasons && input.originalSelectedLayers ? formatSkippedLayers(input.layerSkipReasons, input.originalSelectedLayers) : [];
   const lines = [
     ...generateFinalHeader(exitCode, effectiveBranchName, supabaseUrl, schemaDrift, runUrl),
     ...layerLines.length > 0 ? ["### \u30C6\u30B9\u30C8\u7D50\u679C", ...layerLines, ""] : [],
     ...skippedLayersLines,
-    ...formatSchemaMatrix(
-      input.schemaStats,
-      schemaDrift?.gitDiff ?? null,
-      input.expectedDrift ?? []
-    ),
-    ...generateSchemaDetailsSection(schemaDrift),
-    ...generateDeploySection(
-      exitCode,
-      layerResults,
-      gitBranchName,
-      input.productionPreview,
-      schemaDrift,
-      input.schemaStats ?? null,
-      input.expectedDrift ?? [],
-      env
-    ),
+    ...generateSchemaDetailsSection(schemaDrift),
+    ...wrapObservabilitySection(generateObservabilitySectionBody(input)),
     "<sub>\u{1F916} RUNA CI \u751F\u6210</sub>"
   ];
   return lines.join("\n");
@@ -6937,18 +7867,20 @@ function calculateTotalElapsed(stepTimings2) {
   if (!stepTimings2) return 0;
   return Object.values(stepTimings2).reduce((sum, t) => sum + (t ?? 0), 0);
 }
-function formatProgressBar(completedSteps, failedStep) {
+function formatProgressBar(currentStep, completedSteps, failedStep, skippedSteps) {
   const total = CI_STEPS.length;
-  const completed = failedStep ? completedSteps.length + 1 : completedSteps.length;
+  const completedBase = completedSteps.length + skippedSteps.length;
+  const completed = failedStep ? completedBase : completedBase + 1;
   const percentage = Math.round(completed / total * 100);
   const filled = Math.round(percentage / 10);
   const empty = 10 - filled;
   const bar = "\u2588".repeat(filled) + "\u2591".repeat(empty);
   return `\`${bar}\` ${percentage}%`;
 }
-function getStepStatus(step, currentStep, completedSteps, failedStep) {
+function getStepStatus(step, currentStep, completedSteps, failedStep, skippedSteps) {
   if (failedStep === step) return "failed";
   if (completedSteps.includes(step)) return "passed";
+  if (skippedSteps.includes(step)) return "skipped";
   if (currentStep === step) return "running";
   return "pending";
 }
@@ -7014,6 +7946,8 @@ function formatRunTestsDetail(layerResults) {
 var stepDetailHandlers = {
   syncSchema: (_status, schemaDrift) => formatSyncSchemaDetail(schemaDrift),
   applySeeds: () => "ci.sql + prerequisite seeds",
+  postSeedChecks: (status) => status === "passed" ? "db roles \u5B8C\u4E86" : "db roles \u3067\u505C\u6B62",
+  observability: (status) => status === "passed" ? "\u672C\u756A\u6BD4\u8F03\u30FBschema stats \u5B8C\u4E86" : "\u672C\u756A\u6BD4\u8F03\u307E\u305F\u306Fschema stats \u3067\u505C\u6B62",
   staticChecks: (status) => status === "passed" ? "\u578B\u30C1\u30A7\u30C3\u30AF \u2713 lint \u2713" : "\u578B\u30C1\u30A7\u30C3\u30AF \u2717 \u307E\u305F\u306F lint \u2717",
   build: (status) => status === "passed" ? "\u30A2\u30D7\u30EA\u30D3\u30EB\u30C9\u5B8C\u4E86, Playwright\u6E96\u5099\u5B8C\u4E86" : "\u30D3\u30EB\u30C9\u5931\u6557",
   runTests: (_status, _schemaDrift, layerResults) => formatRunTestsDetail(layerResults)
@@ -7028,6 +7962,8 @@ function getStepDescription(step) {
     setup: "\u30BB\u30C3\u30C8\u30A2\u30C3\u30D7",
     syncSchema: "\u30B9\u30AD\u30FC\u30DE\u540C\u671F",
     applySeeds: "Seed\u9069\u7528",
+    postSeedChecks: "\u30ED\u30FC\u30EB\u6E96\u5099",
+    observability: "\u672C\u756A\u6BD4\u8F03\u30FBschema stats",
     staticChecks: "\u9759\u7684\u30C1\u30A7\u30C3\u30AF",
     build: "\u30D3\u30EB\u30C9",
     runTests: "\u30C6\u30B9\u30C8\u5B9F\u884C",
@@ -7035,7 +7971,25 @@ function getStepDescription(step) {
   };
   return descriptions[step] || step;
 }
-function generateProgressHeader(failedStep, completedSteps, totalElapsed) {
+function getRunningStepDetail(step, detail, productionPreview) {
+  if (step !== "observability") {
+    return detail;
+  }
+  if (!productionPreview) {
+    return "production preview \u5B9F\u884C\u4E2D";
+  }
+  if (productionPreview.error) {
+    return "production preview \u5931\u6557, schema stats \u306F\u88DC\u52A9\u60C5\u5831\u306E\u307F";
+  }
+  if (productionPreview.executed && productionPreview.hasChanges) {
+    return "\u672C\u756A\u5DEE\u5206\u3092\u691C\u51FA, schema stats \u306F\u7701\u7565\u4E88\u5B9A";
+  }
+  if (productionPreview.executed) {
+    return "production preview \u5B8C\u4E86, schema stats \u53CE\u96C6\u4E2D";
+  }
+  return detail;
+}
+function generateProgressHeader(currentStep, failedStep, completedSteps, skippedSteps, totalElapsed) {
   const lines = ["## RUNA CI", ""];
   if (failedStep) {
     const stepDesc = getStepDescription(failedStep);
@@ -7045,7 +7999,9 @@ function generateProgressHeader(failedStep, completedSteps, totalElapsed) {
       `> \`${failedStep}\` \u3067\u51E6\u7406\u304C\u505C\u6B62\u3057\u307E\u3057\u305F\u3002\u4E0B\u8A18\u306E\u30A8\u30E9\u30FC\u8A73\u7D30\u3068\u4FEE\u6B63\u65B9\u6CD5\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002`
     );
   } else {
-    lines.push(`**\u{1F504} \u5B9F\u884C\u4E2D...** ${formatProgressBar(completedSteps, failedStep)}`);
+    lines.push(
+      `**\u{1F504} \u5B9F\u884C\u4E2D...** ${formatProgressBar(currentStep, completedSteps, failedStep, skippedSteps)}`
+    );
   }
   if (totalElapsed > 0) {
     lines.push(`<sub>\u23F1\uFE0F \u7D4C\u904E\u6642\u9593: ${formatDuration4(totalElapsed)}</sub>`);
@@ -7062,16 +8018,17 @@ function generateInfoLine(branchName, supabaseUrl, runUrl) {
   if (runUrl) items.push(`[\u{1F517} \u30EF\u30FC\u30AF\u30D5\u30ED\u30FC](${runUrl})`);
   return [items.join(" \xB7 "), ""];
 }
-function generateProgressSteps(currentStep, completedSteps, failedStep, stepTimings2, schemaDrift, layerResults) {
+function generateProgressSteps(currentStep, completedSteps, failedStep, skippedSteps, stepTimings2, schemaDrift, layerResults, productionPreview) {
   const lines = ["### \u9032\u6357", ""];
   for (const { step, label, detail } of CI_STEPS) {
-    const status = getStepStatus(step, currentStep, completedSteps, failedStep);
+    const status = getStepStatus(step, currentStep, completedSteps, failedStep, skippedSteps);
     const icon = getStepIcon(status);
     const timing = stepTimings2?.[step];
     const timingStr = timing !== void 0 ? ` \`${formatDuration4(timing)}\`` : "";
     const stepDetail = getStepDetail(step, status, schemaDrift, layerResults);
-    if (status === "running" && detail) {
-      lines.push(`${icon} **${label}**${timingStr} \u2014 _${detail}_`);
+    const runningDetail = getRunningStepDetail(step, detail, productionPreview);
+    if (status === "running" && runningDetail) {
+      lines.push(`${icon} **${label}**${timingStr} \u2014 _${runningDetail}_`);
     } else if (status === "passed" && stepDetail) {
       lines.push(`${icon} ${label}${timingStr} \u2014 ${stepDetail}`);
     } else {
@@ -7095,6 +8052,15 @@ function getFixSuggestions(failedStep) {
       "\u30B9\u30AD\u30FC\u30DE\u3068seed\u306E\u4E0D\u4E00\u81F4\u3092\u78BA\u8A8D: runa db sync \u3092\u5148\u306B\u5B9F\u884C",
       "ci.sql\u304C\u5B58\u5728\u3059\u308B\u304B\u78BA\u8A8D: ls supabase/seeds/"
     ],
+    postSeedChecks: [
+      "db:setup-roles \u306E\u30B9\u30AF\u30EA\u30D7\u30C8\u6709\u7121\u3068\u5B9F\u884C\u7D50\u679C\u3092\u78BA\u8A8D",
+      "workflow \u5074\u306E local DB / DATABASE_URL \u6E96\u5099\u72B6\u614B\u3092\u78BA\u8A8D"
+    ],
+    observability: [
+      "production preview / schema stats \u306E\u30ED\u30B0\u3092\u78BA\u8A8D",
+      "\u672C\u756A DB \u63A5\u7D9A\u60C5\u5831\u3068 compare-only dry-run \u306E\u51FA\u529B\u3092\u78BA\u8A8D",
+      "schema stats \u304C\u5FC5\u8981\u306A\u30B1\u30FC\u30B9\u304B expected drift \u8A2D\u5B9A\u3092\u78BA\u8A8D"
+    ],
     staticChecks: [
       "\u30ED\u30FC\u30AB\u30EB\u3067\u578B\u30C1\u30A7\u30C3\u30AF: pnpm type-check",
       "\u30ED\u30FC\u30AB\u30EB\u3067lint: pnpm lint",
@@ -7114,12 +8080,13 @@ function generateErrorSection(error, failedStep) {
   if (!error && !failedStep) return [];
   const lines = [];
   if (error) {
+    const sanitized = error.substring(0, 1e3).replace(/`/g, "'");
     lines.push(
       "<details open>",
       "<summary>\u274C \u30A8\u30E9\u30FC\u8A73\u7D30</summary>",
       "",
       "```",
-      error.substring(0, 1e3),
+      sanitized,
       error.length > 1e3 ? "... (\u7701\u7565)" : "",
       "```"
     );
@@ -7156,7 +8123,7 @@ function generateTestResultsSection(layerResults) {
     ""
   ];
 }
-function generateProductionSchemaSection(productionPreview, deployStatus, env) {
+function generateProductionSchemaSection(productionPreview, phase, deployStatus, env) {
   const lines = ["### \u{1F4CB} \u672C\u756A\u30B9\u30AD\u30FC\u30DE\u72B6\u6CC1", ""];
   const state = resolveProductionSchemaState(productionPreview, deployStatus);
   switch (state) {
@@ -7171,6 +8138,7 @@ function generateProductionSchemaSection(productionPreview, deployStatus, env) {
       break;
     case "error":
       lines.push(`\u274C **\u30A8\u30E9\u30FC**: ${productionPreview?.error ?? ""}`, "");
+      appendDeployLink(lines, env);
       break;
     case "in-sync":
       lines.push("\u2705 **\u672C\u756A\u3068\u540C\u671F\u6E08\u307F** \u2014 \u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u306A\u3057", "");
@@ -7271,19 +8239,27 @@ function generateProgressCommentBody(input) {
   const totalElapsed = calculateTotalElapsed(stepTimings2);
   const gitBranchName = input.prContext?.headBranch ?? branchName ?? "unknown";
   const lines = [
-    ...generateProgressHeader(failedStep, completedSteps, totalElapsed),
+    ...generateProgressHeader(
+      currentStep,
+      failedStep,
+      completedSteps,
+      input.skippedSteps ?? [],
+      totalElapsed
+    ),
     ...generateInfoLine(effectiveBranchName, supabaseUrl, runUrl),
     ...generateProgressSteps(
       currentStep,
       completedSteps,
       failedStep,
+      input.skippedSteps ?? [],
       stepTimings2,
       schemaDrift,
-      input.layerResults
+      input.layerResults,
+      productionPreview
     ),
     ...generateErrorSection(error ?? void 0, failedStep),
     ...generateTestResultsSection(input.layerResults),
-    ...generateProductionSchemaSection(productionPreview, deployStatus, env),
+    ...generateProductionSchemaSection(productionPreview, input.phase, deployStatus, env),
     ...generateDbDeploySection(input.layerResults, gitBranchName, productionPreview, env)
   ];
   const jst = new Date(Date.now() + 9 * 60 * 60 * 1e3);
@@ -7299,6 +8275,7 @@ function createCommentInput(context, options) {
     .../* @__PURE__ */ new Set([...skippedLayerNumbers, ...context.selectedLayers])
   ].sort((a, b) => a - b);
   return {
+    phase: context.input.phase ?? "all",
     exitCode: context.exitCode,
     branchName: context.branchName,
     prContext: context.prContext,
@@ -7315,10 +8292,14 @@ function createCommentInput(context, options) {
   };
 }
 function createProgressCommentInput(context, currentStep, completedSteps, failedStep = null, stepTimings2) {
+  const phase = context.input.phase ?? "all";
+  const skippedSteps = phase === "test" ? ["syncSchema", "applySeeds", "observability"] : [];
   return {
+    phase,
     currentStep,
     completedSteps,
     failedStep,
+    skippedSteps,
     branchName: context.branchName,
     prContext: context.prContext,
     supabase: context.supabase,
@@ -7392,6 +8373,18 @@ function computeExitCode(summary, classification) {
 
 // src/commands/ci/machine/types.ts
 init_esm_shims();
+function resolveInitialPrContext(input) {
+  if (input.command !== "pr") return null;
+  const prNumberMatch = input.githubRef?.match(/refs\/pull\/(\d+)/);
+  const prNumber = prNumberMatch?.[1] ? Number.parseInt(prNumberMatch[1], 10) : null;
+  return {
+    prNumber,
+    action: input.githubEventAction ?? null,
+    sha: input.githubSha ?? null,
+    baseBranch: input.githubBaseRef ?? null,
+    headBranch: input.githubHeadRef ?? null
+  };
+}
 function createInitialContext(input) {
   return {
     input,
@@ -7401,10 +8394,10 @@ function createInitialContext(input) {
     tmpDir: null,
     // Resolve executionEnv from input (captured at CLI entry point)
     executionEnv: input.isGitHubActions ? "github-actions" : "local",
-    phase: "all",
+    phase: input.phase ?? "all",
     repoKind: "unknown",
-    branchName: null,
-    prContext: null,
+    branchName: input.branchName ?? input.githubHeadRef ?? null,
+    prContext: resolveInitialPrContext(input),
     policy: null,
     app: null,
     appPid: null,
@@ -7426,7 +8419,9 @@ function createInitialContext(input) {
     layerResults: {},
     testsRun: false,
     layerSkipReasons: {},
+    stepOverrides: {},
     summary: null,
+    diagnostics: {},
     summaryPath: null,
     schemaDrift: null,
     productionPreview: null,
@@ -7503,6 +8498,7 @@ function createSummaryInput(context) {
     durationMs: Date.now() - context.startTime,
     repoKind: context.repoKind,
     detected: {},
+    diagnostics: context.diagnostics,
     steps: {},
     layers: formatLayerSummary(context.layerResults),
     errors: formatErrors(context.error)
@@ -7646,7 +8642,7 @@ function createBuildAndPlaywrightInput(context) {
       enablePublicE2EFlag: true
     }),
     isCI: context.input.isCI ?? false,
-    skipPlaywright: !context.selectedLayers.includes(4)
+    skipPlaywright: !context.selectedLayers.includes(4) || shouldReusePreparedPlaywright(context)
   };
 }
 function createAppStartInput(context) {
@@ -7717,7 +8713,6 @@ var ciMachine = setup({
     capabilities: capabilitiesActor,
     runLayers: runLayersActor,
     // Finalize
-    writeSummary: writeSummaryActor,
     upsertComment: upsertCommentActor
   },
   guards: {
@@ -7797,6 +8792,7 @@ var ciMachine = setup({
                   databaseUrlRaw: event.output.databaseUrl,
                   appDatabaseUrl: void 0
                 }),
+                diagnostics: ({ event }) => event.output.diagnostics ?? {},
                 selectedLayers: ({ event }) => event.output.layers,
                 error: ({ event }) => event.output.error ?? null
               })
@@ -7818,6 +8814,9 @@ var ciMachine = setup({
               verbose: context.input.verbose,
               layers: context.input.layers,
               databaseUrl: context.input.databaseUrl,
+              skipLocalDbStart: context.input.skipLocalDbStart,
+              assumeSupabaseReady: context.input.assumeSupabaseReady,
+              skipPlaywrightInstall: context.input.skipPlaywrightInstall,
               // GitHub context (captured at entry point)
               githubRef: context.input.githubRef,
               githubEventAction: context.input.githubEventAction,
@@ -7841,6 +8840,7 @@ var ciMachine = setup({
                   databaseUrlRaw: event.output.databaseUrl,
                   appDatabaseUrl: void 0
                 }),
+                diagnostics: ({ event }) => event.output.diagnostics ?? {},
                 selectedLayers: ({ event }) => event.output.layers,
                 expectedDrift: ({ event }) => event.output.expectedDrift ?? [],
                 error: ({ event }) => event.output.error ?? null
@@ -7874,6 +8874,10 @@ var ciMachine = setup({
       // Skip if ci-local mode (no GitHub comment)
       always: [
         { guard: "isCiLocalMode", target: "dbReset" },
+        {
+          guard: ({ context }) => isTestPhase(context),
+          target: "setupRoles"
+        },
         {
           guard: ({ context }) => !shouldPostGitHubComment(context) || !context.prContext?.prNumber,
           target: "syncSchema"
@@ -7882,8 +8886,20 @@ var ciMachine = setup({
       invoke: {
         src: "upsertComment",
         input: ({ context }) => createInitialCommentRequest(context),
-        onDone: { target: "syncSchema" },
-        onError: { target: "syncSchema" }
+        onDone: [
+          {
+            guard: ({ context }) => isTestPhase(context),
+            target: "setupRoles"
+          },
+          { target: "syncSchema" }
+        ],
+        onError: [
+          {
+            guard: ({ context }) => isTestPhase(context),
+            target: "setupRoles"
+          },
+          { target: "syncSchema" }
+        ]
         // Non-critical, continue even if comment fails
       }
     },
@@ -7964,7 +8980,8 @@ var ciMachine = setup({
           repoRoot: assertRepoRoot(context),
           tmpDir: assertTmpDir(context),
           databaseUrl: context.supabase?.databaseUrlRaw ?? "",
-          mode: context.mode
+          mode: context.mode,
+          skipPostCheck: shouldSkipSchemaPostCheck(context)
         }),
         onDone: [
           {
@@ -8054,7 +9071,16 @@ var ciMachine = setup({
                 onDone: {
                   target: "staticChecks",
                   actions: assign({
-                    rolesSetup: true,
+                    rolesSetup: ({ event }) => event.output.skipped !== true,
+                    stepOverrides: ({ context, event }) => ({
+                      ...context.stepOverrides,
+                      ...event.output.skipped ? {
+                        "postSeedPr.execution.setupRoles": {
+                          status: "skipped",
+                          reason: event.output.skipReason ?? "Skipped because db:setup-roles is unavailable"
+                        }
+                      } : {}
+                    }),
                     supabase: ({ context, event }) => mergeSetupRolesSupabase(context, event.output.appDatabaseUrl)
                   })
                 },
@@ -8334,6 +9360,12 @@ var ciMachine = setup({
           initial: "productionPreview",
           states: {
             productionPreview: {
+              always: [
+                {
+                  guard: ({ context }) => !hasSchemaGitChanges(context),
+                  target: "done"
+                }
+              ],
               invoke: {
                 src: "productionPreview",
                 input: ({ context }) => ({
@@ -8362,6 +9394,16 @@ var ciMachine = setup({
               }
             },
             collectSchemaStats: {
+              always: [
+                {
+                  guard: ({ context }) => !hasSchemaGitChanges(context),
+                  target: "done"
+                },
+                {
+                  guard: ({ context }) => context.productionPreview?.hasChanges === true,
+                  target: "done"
+                }
+              ],
               invoke: {
                 src: "collectSchemaStats",
                 input: ({ context }) => ({
@@ -8370,6 +9412,8 @@ var ciMachine = setup({
                   ciDbUrl: context.supabase?.databaseUrlRaw ?? null,
                   referenceStrategy: shouldReuseCiReferenceStats(context) ? "reuse-ci" : "rebuild",
                   queryProduction: true,
+                  includeCiSemantic: false,
+                  expectedDrift: context.expectedDrift,
                   tmpDir: context.tmpDir ?? process.cwd()
                 }),
                 onDone: {
@@ -8467,7 +9511,6 @@ var ciMachine = setup({
           })
         },
         onError: {
-          // Non-critical, continue without schema stats
           target: "decidePath",
           actions: assign({
             schemaStats: () => null
@@ -8865,19 +9908,9 @@ var ciMachine = setup({
       initial: "writeSummary",
       states: {
         writeSummary: {
-          invoke: {
-            src: "writeSummary",
-            input: ({ context }) => createWriteSummaryRequest(context),
-            onDone: {
-              target: "postComment",
-              actions: assign({ summaryPath: ({ event }) => event.output.filePath })
-            },
-            onError: {
-              target: "postComment"
-            }
-          }
-        },
-        postComment: {
+          entry: assign({
+            summary: ({ context }) => createWriteSummaryRequest(context).summary
+          }),
           always: [
             {
               guard: ({ context }) => !shouldPostGitHubComment(context),
@@ -8886,8 +9919,11 @@ var ciMachine = setup({
             {
               guard: ({ context }) => !context.prContext?.prNumber,
               target: "complete"
-            }
-          ],
+            },
+            { target: "postComment" }
+          ]
+        },
+        postComment: {
           invoke: {
             src: "upsertComment",
             input: ({ context }) => createFinalCommentRequest(context),
@@ -8970,16 +10006,492 @@ function isComplete(snapshot) {
 
 // src/commands/ci/machine/commands/machine-runner.ts
 init_esm_shims();
+
+// src/commands/ci/machine/commands/step-telemetry.ts
+init_esm_shims();
+var STEP_METADATA = {
+  "setup.local": {
+    order: 10,
+    title: "Setup local environment",
+    phase: "setup"
+  },
+  "setup.prLocal": {
+    order: 10,
+    title: "Setup PR local environment",
+    phase: "setup"
+  },
+  initialComment: {
+    order: 20,
+    title: "Post initial progress comment",
+    phase: "github",
+    optional: true
+  },
+  syncSchema: {
+    order: 30,
+    title: "Apply preview schema",
+    phase: "db"
+  },
+  applySeeds: {
+    order: 40,
+    title: "Apply CI seeds",
+    phase: "db"
+  },
+  productionPreview: {
+    order: 50,
+    title: "Run production preview",
+    phase: "observability",
+    optional: true,
+    parentStep: "applySeeds"
+  },
+  collectSchemaStats: {
+    order: 60,
+    title: "Collect schema statistics",
+    phase: "observability",
+    optional: true,
+    parentStep: "applySeeds"
+  },
+  "postSeedPr.observability.productionPreview": {
+    order: 50,
+    title: "Run production preview",
+    phase: "observability",
+    optional: true,
+    parentStep: "applySeeds"
+  },
+  "postSeedPr.observability.collectSchemaStats": {
+    order: 60,
+    title: "Collect schema statistics",
+    phase: "observability",
+    optional: true,
+    parentStep: "applySeeds"
+  },
+  "postSeedPr.execution.setupRoles": {
+    order: 70,
+    title: "Setup database roles",
+    phase: "db",
+    optional: true,
+    parentStep: "applySeeds"
+  },
+  "postSeedPr.execution.staticChecks": {
+    order: 80,
+    title: "Run static checks",
+    phase: "build"
+  },
+  "postSeedPr.execution.buildAndPlaywright": {
+    order: 90,
+    title: "Build app and prepare Playwright",
+    phase: "build"
+  },
+  "postSeedPr.execution.buildAndPlaywright.build": {
+    order: 91,
+    title: "Build application",
+    phase: "build",
+    parentStep: "postSeedPr.execution.buildAndPlaywright"
+  },
+  "postSeedPr.execution.buildAndPlaywright.manifestGenerate": {
+    order: 92,
+    title: "Generate manifest",
+    phase: "build",
+    optional: true,
+    parentStep: "postSeedPr.execution.buildAndPlaywright"
+  },
+  "postSeedPr.execution.buildAndPlaywright.playwrightInstall": {
+    order: 93,
+    title: "Install Playwright browsers",
+    phase: "build",
+    optional: true,
+    parentStep: "postSeedPr.execution.buildAndPlaywright"
+  },
+  "postSeedPr.execution.appStart": {
+    order: 100,
+    title: "Start application",
+    phase: "build"
+  },
+  "postSeedPr.execution.capabilities": {
+    order: 110,
+    title: "Detect test capabilities",
+    phase: "test",
+    optional: true
+  },
+  "postSeedPr.execution.runCoreTests": {
+    order: 120,
+    title: "Run core test layers",
+    phase: "test"
+  },
+  "postSeedPr.execution.e2ePhase": {
+    order: 130,
+    title: "Run E2E phase",
+    phase: "test",
+    optional: true
+  },
+  "finalize.writeSummary": {
+    order: 140,
+    title: "Write CI summary",
+    phase: "finalize"
+  },
+  "finalize.postComment": {
+    order: 150,
+    title: "Post final GitHub comment",
+    phase: "finalize",
+    optional: true
+  }
+};
+var CANONICAL_STEP_IDS = Object.keys(STEP_METADATA).sort((a, b) => b.length - a.length);
+function toIsoString(timestampMs) {
+  return new Date(timestampMs).toISOString();
+}
+function getMetadata(stepId) {
+  return STEP_METADATA[stepId];
+}
+function getCanonicalStepId(statePath) {
+  for (const stepId of CANONICAL_STEP_IDS) {
+    if (statePath === stepId || statePath.startsWith(`${stepId}.`)) {
+      return stepId;
+    }
+  }
+  return null;
+}
+function getStepOrderFromStatePath(statePath) {
+  const canonical = getCanonicalStepId(statePath);
+  if (!canonical) return -1;
+  return STEP_METADATA[canonical]?.order ?? -1;
+}
+function pickPrimaryStatePath(statePaths, previousStatePath) {
+  if (statePaths.length === 0) return previousStatePath;
+  if (statePaths.length === 1 && (statePaths[0] === "done" || statePaths[0] === "failed")) {
+    return statePaths[0];
+  }
+  const sorted = [...statePaths].sort(
+    (a, b) => getStepOrderFromStatePath(b) - getStepOrderFromStatePath(a)
+  );
+  const candidate = sorted[0];
+  if (!previousStatePath) return candidate;
+  return getStepOrderFromStatePath(candidate) >= getStepOrderFromStatePath(previousStatePath) ? candidate : previousStatePath;
+}
+function createSkippedSummary(stepId, reason) {
+  return createSyntheticSummary(stepId, "skipped", { reason });
+}
+function createSyntheticSummary(stepId, status, params = {}) {
+  const metadata = getMetadata(stepId);
+  if (!metadata) return null;
+  const durationMs = params.startedAtMs !== void 0 && params.endedAtMs !== void 0 ? Math.max(0, params.endedAtMs - params.startedAtMs) : void 0;
+  return [
+    stepId,
+    {
+      status,
+      title: metadata.title,
+      phase: metadata.phase,
+      parentStep: metadata.parentStep,
+      optional: metadata.optional,
+      reason: params.reason,
+      startedAt: params.startedAtMs !== void 0 ? toIsoString(params.startedAtMs) : void 0,
+      endedAt: params.endedAtMs !== void 0 ? toIsoString(params.endedAtMs) : void 0,
+      durationMs
+    }
+  ];
+}
+function getBuildSkipReason(context) {
+  return isCiLocalMode(context) ? "Skipped in ci-local mode" : context.input.skipBuild === true ? "Skipped by --skip-build" : "Skipped by step guard";
+}
+function getPlaywrightSkipReason(context) {
+  if (isCiLocalMode(context)) return "Skipped in ci-local mode";
+  if (!context.selectedLayers.includes(4)) return "Skipped because Layer 4 is not selected";
+  if (shouldReusePreparedPlaywright(context)) {
+    return "Reused workflow-prepared Playwright browsers";
+  }
+  if (context.input.skipPlaywrightInstall === true) {
+    return "Skipped by --skip-playwright-install";
+  }
+  return "Skipped by step guard";
+}
+function getSyntheticBuildEntries(context, trackedStepIds, _stepStates, _nowMs) {
+  const entries = [];
+  const pushEntry = (entry) => {
+    if (!entry) return;
+    if (trackedStepIds.has(entry[0])) return;
+    entries.push(entry);
+  };
+  const syntheticTimingParams = {};
+  if (shouldSkipBuild(context)) {
+    const reason = getBuildSkipReason(context);
+    pushEntry(createSkippedSummary("postSeedPr.execution.buildAndPlaywright.build", reason));
+    pushEntry(
+      createSkippedSummary("postSeedPr.execution.buildAndPlaywright.manifestGenerate", reason)
+    );
+    pushEntry(
+      createSkippedSummary("postSeedPr.execution.buildAndPlaywright.playwrightInstall", reason)
+    );
+    return entries;
+  }
+  if (context.appBuildPassed === true) {
+    pushEntry(
+      createSyntheticSummary(
+        "postSeedPr.execution.buildAndPlaywright.build",
+        "passed",
+        syntheticTimingParams
+      )
+    );
+  } else if (context.appBuildPassed === false) {
+    pushEntry(
+      createSyntheticSummary("postSeedPr.execution.buildAndPlaywright.build", "failed", {
+        ...syntheticTimingParams,
+        reason: context.error ?? "App build failed"
+      })
+    );
+  }
+  if (context.appBuildPassed === true) {
+    if (context.manifestGenerated === true) {
+      pushEntry(
+        createSyntheticSummary(
+          "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
+          "passed",
+          syntheticTimingParams
+        )
+      );
+    } else if (context.manifestGenerated === null) {
+      pushEntry(
+        createSyntheticSummary(
+          "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
+          "skipped",
+          {
+            ...syntheticTimingParams,
+            reason: "Skipped because manifest generation is optional for this repository"
+          }
+        )
+      );
+    } else if (context.manifestGenerated === false) {
+      pushEntry(
+        createSyntheticSummary(
+          "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
+          "failed",
+          {
+            ...syntheticTimingParams,
+            reason: "Manifest generation failed but CI continued because it is optional"
+          }
+        )
+      );
+    }
+  } else if (context.appBuildPassed === false) {
+    pushEntry(
+      createSyntheticSummary(
+        "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
+        "skipped",
+        {
+          ...syntheticTimingParams,
+          reason: "Skipped because app build failed before manifest generation"
+        }
+      )
+    );
+  }
+  if (shouldReusePreparedPlaywright(context)) {
+    pushEntry(
+      createSyntheticSummary(
+        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
+        "skipped",
+        {
+          ...syntheticTimingParams,
+          reason: getPlaywrightSkipReason(context)
+        }
+      )
+    );
+  } else if (shouldSkipPlaywrightInstall(context)) {
+    pushEntry(
+      createSyntheticSummary(
+        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
+        "skipped",
+        {
+          ...syntheticTimingParams,
+          reason: getPlaywrightSkipReason(context)
+        }
+      )
+    );
+  } else if (context.playwrightInstalled === true) {
+    pushEntry(
+      createSyntheticSummary(
+        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
+        "passed",
+        syntheticTimingParams
+      )
+    );
+  } else if (context.playwrightInstalled === false) {
+    pushEntry(
+      createSyntheticSummary(
+        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
+        "failed",
+        {
+          ...syntheticTimingParams,
+          reason: "Playwright browser install failed"
+        }
+      )
+    );
+  }
+  return entries;
+}
+function getSkippedStepEntries(context, trackedStepIds) {
+  const skipped = [];
+  const pushSkipped = (stepId, reason) => {
+    if (trackedStepIds.has(stepId)) return;
+    const entry = createSkippedSummary(stepId, reason);
+    if (entry) skipped.push(entry);
+  };
+  if (isTestPhase(context)) {
+    pushSkipped("syncSchema", "Skipped in phase=test; reusing prepared database");
+    pushSkipped("applySeeds", "Skipped in phase=test; reusing prepared database");
+    pushSkipped(
+      "postSeedPr.observability.productionPreview",
+      "Skipped in phase=test; observability DB checks are disabled"
+    );
+    pushSkipped(
+      "postSeedPr.observability.collectSchemaStats",
+      "Skipped in phase=test; observability DB checks are disabled"
+    );
+  }
+  if (!shouldPostGitHubComment(context) || context.prContext?.prNumber === null) {
+    const commentReason = context.input.skipGithubComment === true ? "Skipped by --skip-github-comment" : context.executionEnv !== "github-actions" ? "Skipped outside GitHub Actions" : "Skipped because PR context is unavailable";
+    pushSkipped("initialComment", commentReason);
+    pushSkipped("finalize.postComment", commentReason);
+  }
+  if (shouldSkipStaticChecks(context)) {
+    const reason = isCiLocalMode(context) ? "Skipped in ci-local mode" : context.input.skipStaticChecks === true ? "Skipped by --skip-static-checks" : "Skipped by step guard";
+    pushSkipped("postSeedPr.execution.staticChecks", reason);
+  }
+  if (shouldSkipBuild(context)) {
+    pushSkipped("postSeedPr.execution.buildAndPlaywright", getBuildSkipReason(context));
+  }
+  if (shouldSkipAppStart(context)) {
+    const reason = isCiLocalMode(context) ? "Skipped in ci-local mode" : !context.selectedLayers.includes(4) ? "Skipped because Layer 4 is not selected" : "Skipped by step guard";
+    pushSkipped("postSeedPr.execution.appStart", reason);
+  }
+  if (!context.selectedLayers.includes(4)) {
+    pushSkipped("postSeedPr.execution.e2ePhase", "Skipped because Layer 4 is not selected");
+  } else if (Object.values(context.layerResults).some((result) => result.status === "failed")) {
+    pushSkipped("postSeedPr.execution.e2ePhase", "Skipped because blocking core tests failed");
+  }
+  return skipped;
+}
+function createStepTelemetryTracker() {
+  const stepStates = /* @__PURE__ */ new Map();
+  let activeStepIds = /* @__PURE__ */ new Set();
+  const startStep = (stepId, nowMs) => {
+    const metadata = getMetadata(stepId);
+    if (!metadata) return;
+    if (stepStates.has(stepId)) return;
+    stepStates.set(stepId, {
+      metadata,
+      startedAtMs: nowMs,
+      status: "running"
+    });
+  };
+  const finishStep = (stepId, status, nowMs) => {
+    const existing = stepStates.get(stepId);
+    if (!existing || existing.status !== "running") return;
+    existing.status = status;
+    existing.endedAtMs = nowMs;
+  };
+  return {
+    transition(statePaths, nowMs = Date.now()) {
+      const nextStepIds = new Set(
+        statePaths.map((statePath) => getCanonicalStepId(statePath)).filter((value) => value !== null)
+      );
+      for (const stepId of activeStepIds) {
+        if (!nextStepIds.has(stepId)) {
+          finishStep(stepId, "passed", nowMs);
+        }
+      }
+      for (const stepId of nextStepIds) {
+        if (!activeStepIds.has(stepId)) {
+          startStep(stepId, nowMs);
+        }
+      }
+      activeStepIds = nextStepIds;
+    },
+    finalize({ context, succeeded, failedStatePath, nowMs = Date.now() }) {
+      const failedStepId = failedStatePath ? getCanonicalStepId(failedStatePath) : null;
+      for (const stepId of activeStepIds) {
+        if (stepId === failedStepId) {
+          finishStep(stepId, "failed", nowMs);
+          continue;
+        }
+        const metadata = getMetadata(stepId);
+        finishStep(stepId, succeeded ? "passed" : metadata?.optional ? "killed" : "killed", nowMs);
+      }
+      activeStepIds = /* @__PURE__ */ new Set();
+      const trackedEntries = [...stepStates.entries()].sort((a, b) => a[1].metadata.order - b[1].metadata.order).map(([stepId, state]) => {
+        const endedAtMs = state.endedAtMs ?? nowMs;
+        const durationMs = Math.max(0, endedAtMs - state.startedAtMs);
+        const defaultStatus = state.status === "running" ? "killed" : state.status;
+        const override = context.stepOverrides[stepId];
+        const status = override?.status ?? defaultStatus;
+        return [
+          stepId,
+          {
+            status,
+            title: state.metadata.title,
+            phase: state.metadata.phase,
+            parentStep: state.metadata.parentStep,
+            optional: state.metadata.optional,
+            reason: override?.reason ?? (status === "killed" && failedStepId !== null ? `Interrupted after ${failedStepId} failed` : void 0),
+            startedAt: toIsoString(state.startedAtMs),
+            endedAt: toIsoString(endedAtMs),
+            durationMs
+          }
+        ];
+      });
+      const skippedEntries = getSkippedStepEntries(
+        context,
+        new Set(trackedEntries.map(([stepId]) => stepId))
+      );
+      const syntheticBuildEntries = getSyntheticBuildEntries(
+        context,
+        new Set([...trackedEntries, ...skippedEntries].map(([stepId]) => stepId)));
+      return Object.fromEntries(
+        [...trackedEntries, ...skippedEntries, ...syntheticBuildEntries].sort(
+          ([leftStepId], [rightStepId]) => (getMetadata(leftStepId)?.order ?? Number.MAX_SAFE_INTEGER) - (getMetadata(rightStepId)?.order ?? Number.MAX_SAFE_INTEGER)
+        )
+      );
+    }
+  };
+}
+
+// src/commands/ci/machine/commands/machine-runner.ts
 var FLUSH_DELAY_MS = 100;
-var lastProgressUpdateTime = 0;
-var PROGRESS_UPDATE_DEBOUNCE_MS = 2e3;
+var progressUpdateSequence = 0;
 var pendingProgressUpdate = null;
-var progressUpdateCount = 0;
+var progressHeartbeatTimer = null;
+var latestSnapshot = null;
+var heartbeatStep = null;
+var heartbeatFailedStep = null;
 var progressUpdateSuccessCount = 0;
-var progressUpdateFailCount = 0;
 var stepStartTime = Date.now();
 var currentTrackedStep = null;
 var stepTimings = {};
+var previousActiveSteps = /* @__PURE__ */ new Set();
+var DEFAULT_PROGRESS_HEARTBEAT_MS = 3e4;
+var HEARTBEAT_ELIGIBLE_STEPS = /* @__PURE__ */ new Set([
+  "syncSchema",
+  "applySeeds",
+  "postSeedChecks",
+  "observability",
+  "build",
+  "runTests"
+]);
+function resetProgressTracking() {
+  progressUpdateSequence = 0;
+  pendingProgressUpdate = null;
+  if (progressHeartbeatTimer) {
+    clearInterval(progressHeartbeatTimer);
+    progressHeartbeatTimer = null;
+  }
+  latestSnapshot = null;
+  heartbeatStep = null;
+  heartbeatFailedStep = null;
+  progressUpdateSuccessCount = 0;
+  previousActiveSteps = /* @__PURE__ */ new Set();
+  stepStartTime = Date.now();
+  currentTrackedStep = null;
+  for (const key of Object.keys(stepTimings)) {
+    delete stepTimings[key];
+  }
+}
 var STATE_TO_STEP = {
   // Setup phase
   setup: "setup",
@@ -8992,8 +10504,14 @@ var STATE_TO_STEP = {
   pullProduction: "syncSchema",
   syncSchema: "syncSchema",
   applySeeds: "applySeeds",
-  postSeedPr: "applySeeds",
-  "postSeedPr.execution.setupRoles": "applySeeds",
+  productionPreview: "observability",
+  collectSchemaStats: "observability",
+  postSeedPr: "postSeedChecks",
+  "postSeedPr.execution": "postSeedChecks",
+  "postSeedPr.observability": "observability",
+  "postSeedPr.execution.setupRoles": "postSeedChecks",
+  "postSeedPr.observability.productionPreview": "observability",
+  "postSeedPr.observability.collectSchemaStats": "observability",
   "postSeedPr.execution.staticChecks": "staticChecks",
   "postSeedPr.execution.buildAndPlaywright": "build",
   "postSeedPr.execution.appStart": "build",
@@ -9003,9 +10521,7 @@ var STATE_TO_STEP = {
   "postSeedPr.execution.coreTestsFailed": "runTests",
   "postSeedPr.execution.e2ePhase": "runTests",
   "postSeedPr.execution.done": "runTests",
-  "postSeedPr.observability.productionPreview": "applySeeds",
-  "postSeedPr.observability.collectSchemaStats": "applySeeds",
-  decidePath: "applySeeds",
+  decidePath: "postSeedChecks",
   installPgTap: "applySeeds",
   setupRoles: "applySeeds",
   // Build phase
@@ -9037,6 +10553,8 @@ var STEP_ORDER = [
   "setup",
   "syncSchema",
   "applySeeds",
+  "postSeedChecks",
+  "observability",
   "staticChecks",
   "build",
   "runTests",
@@ -9053,10 +10571,12 @@ function resolveStepForState(state) {
   }
   return void 0;
 }
-function getCompletedSteps(currentStep) {
-  const currentIndex = STEP_ORDER.indexOf(currentStep);
-  if (currentIndex <= 0) return [];
-  return STEP_ORDER.slice(0, currentIndex);
+function getCompletedSteps(currentStep, stepTimings2 = {}) {
+  const completed = new Set(
+    Object.keys(stepTimings2).filter((step) => STEP_ORDER.includes(step))
+  );
+  completed.delete(currentStep);
+  return STEP_ORDER.filter((step) => completed.has(step));
 }
 function recordStepTiming(newStep) {
   const now = Date.now();
@@ -9066,39 +10586,43 @@ function recordStepTiming(newStep) {
   currentTrackedStep = newStep;
   stepStartTime = now;
 }
+function parseProgressHeartbeatMs(context) {
+  const rawValue = context.input.progressIntervalSeconds?.trim();
+  if (!rawValue) return DEFAULT_PROGRESS_HEARTBEAT_MS;
+  const parsedSeconds = Number.parseInt(rawValue, 10);
+  if (!Number.isFinite(parsedSeconds) || parsedSeconds <= 0) {
+    return DEFAULT_PROGRESS_HEARTBEAT_MS;
+  }
+  return parsedSeconds * 1e3;
+}
+function stopProgressHeartbeat() {
+  if (progressHeartbeatTimer) {
+    clearInterval(progressHeartbeatTimer);
+    progressHeartbeatTimer = null;
+  }
+}
+function refreshProgressHeartbeat(currentStep, failedStep = null) {
+  heartbeatStep = currentStep;
+  heartbeatFailedStep = failedStep;
+  stopProgressHeartbeat();
+  if (!HEARTBEAT_ELIGIBLE_STEPS.has(currentStep)) {
+    return;
+  }
+  const intervalMs = latestSnapshot ? parseProgressHeartbeatMs(latestSnapshot.context) : DEFAULT_PROGRESS_HEARTBEAT_MS;
+  progressHeartbeatTimer = setInterval(() => {
+    if (!latestSnapshot || !heartbeatStep) return;
+    updateProgressComment(latestSnapshot.context, heartbeatStep, heartbeatFailedStep);
+  }, intervalMs);
+  progressHeartbeatTimer.unref?.();
+}
 function updateProgressComment(context, currentStep, failedStep = null) {
-  if (context.executionEnv !== "github-actions") return;
+  if (!shouldPostGitHubComment(context)) return;
   if (!context.prContext?.prNumber) return;
-  if (context.input.skipGithubComment) return;
   const token = process.env.GITHUB_TOKEN?.trim();
   if (!token) return;
   const repository = process.env.GITHUB_REPOSITORY?.trim();
   if (!repository || !repository.includes("/")) return;
-  const now = Date.now();
-  const timeSinceLastUpdate = now - lastProgressUpdateTime;
-  if (timeSinceLastUpdate < PROGRESS_UPDATE_DEBOUNCE_MS) {
-    console.log(
-      `[DEBUG] Progress update debounced: step=${currentStep}, waited=${timeSinceLastUpdate}ms < ${PROGRESS_UPDATE_DEBOUNCE_MS}ms`
-    );
-    return;
-  }
-  lastProgressUpdateTime = now;
-  progressUpdateCount++;
-  const elapsed = Object.values(stepTimings).reduce((sum, t) => sum + (t ?? 0), 0);
-  console.log(
-    `[DEBUG] Progress update #${progressUpdateCount}: step=${currentStep}, elapsed=${Math.round(elapsed / 1e3)}s, failed=${failedStep ?? "none"}`
-  );
-  const completedSteps = getCompletedSteps(currentStep);
-  const progressInput = createProgressCommentInput(
-    context,
-    currentStep,
-    completedSteps,
-    failedStep,
-    { ...stepTimings }
-    // Pass a copy of current timings
-  );
-  const body = `<!-- runa-ci-report -->
-${generateProgressCommentBody(progressInput)}`;
+  const mySeq = ++progressUpdateSequence;
   const doUpdate = async () => {
     if (pendingProgressUpdate) {
       try {
@@ -9106,25 +10630,29 @@ ${generateProgressCommentBody(progressInput)}`;
       } catch {
       }
     }
-    const startTime = Date.now();
+    if (mySeq < progressUpdateSequence) {
+      return;
+    }
+    const freshContext = latestSnapshot?.context ?? context;
+    const completedSteps = getCompletedSteps(currentStep, stepTimings);
+    const progressInput = createProgressCommentInput(
+      freshContext,
+      currentStep,
+      completedSteps,
+      failedStep,
+      { ...stepTimings }
+    );
+    const body = `<!-- runa-ci-report -->
+${generateProgressCommentBody(progressInput)}`;
     try {
       await upsertIssueComment({
         repo: resolveRepoContextFromEnv(),
-        issueNumber: assertPrNumber(context),
+        issueNumber: assertPrNumber(freshContext),
         marker: "<!-- runa-ci-report -->",
         body
       });
       progressUpdateSuccessCount++;
-      const duration = Date.now() - startTime;
-      console.log(
-        `[DEBUG] Progress update #${progressUpdateCount} succeeded: ${duration}ms (total: ${progressUpdateSuccessCount}/${progressUpdateCount})`
-      );
     } catch (error) {
-      progressUpdateFailCount++;
-      const duration = Date.now() - startTime;
-      console.error(
-        `[DEBUG] Progress update #${progressUpdateCount} failed after ${duration}ms: ${error instanceof Error ? error.message : String(error)} (fails: ${progressUpdateFailCount}/${progressUpdateCount})`
-      );
     }
   };
   pendingProgressUpdate = doUpdate();
@@ -9138,46 +10666,108 @@ function determineFailedStep(context) {
   if (!context.repoRoot) return "setup";
   return "setup";
 }
-function handleProgressCommentUpdate(snapshot, prevState) {
-  const currentState = getStateName(snapshot);
+function setsEqual(a, b) {
+  if (a.size !== b.size) return false;
+  for (const item of a) {
+    if (!b.has(item)) return false;
+  }
+  return true;
+}
+function handleProgressCommentUpdate(snapshot, prevState, currentState, activeStatePaths) {
   const context = snapshot.context;
   const currentStep = resolveStepForState(currentState);
   const prevStep = resolveStepForState(prevState);
-  if (!currentStep || currentStep === prevStep) return;
-  recordStepTiming(currentStep);
+  const shouldRefreshWithinStep = currentStep !== void 0 && currentStep === prevStep && currentStep === "observability" && currentState !== prevState;
+  const currentStepSet = new Set(
+    activeStatePaths.map((p) => resolveStepForState(p)).filter((s) => s !== void 0)
+  );
+  const parallelStepChanged = !setsEqual(previousActiveSteps, currentStepSet);
+  previousActiveSteps = currentStepSet;
+  if (!currentStep || !parallelStepChanged && currentStep === prevStep && !shouldRefreshWithinStep)
+    return;
+  if (!shouldRefreshWithinStep) {
+    recordStepTiming(currentStep);
+  }
   if (currentStep === "finalize") {
-    console.log(
-      "[DEBUG] Skipping progress update for finalize step (final comment will be posted by actor)"
-    );
     return;
   }
   const hasFailure = currentState === "failed" || currentState === "testsFailed" || Object.values(context.layerResults).some((r) => r.status === "failed") || context.staticChecksPassed === false || context.appBuildPassed === false;
   const failedStep = hasFailure ? determineFailedStep(context) : null;
   const effectiveStep = currentState === "failed" ? failedStep ?? currentStep : currentStep;
+  if (effectiveStep) {
+    refreshProgressHeartbeat(effectiveStep, failedStep);
+  } else {
+    stopProgressHeartbeat();
+  }
   updateProgressComment(context, effectiveStep, failedStep);
 }
+async function persistSummary(params) {
+  if (params.context.repoRoot === null) return void 0;
+  const summaryInput = params.context.summary !== null ? {
+    cwd: params.context.repoRoot,
+    summary: params.context.summary
+  } : createWriteSummaryRequest(params.context);
+  const nextSummary = {
+    ...summaryInput.summary,
+    steps: params.steps
+  };
+  return await writeCiSummary({
+    cwd: summaryInput.cwd,
+    summary: nextSummary
+  });
+}
 async function runCiMachine(input, logger, onStateChange) {
   return new Promise((resolve, reject) => {
+    resetProgressTracking();
     const actor = createActor(ciMachine, { input });
     let previousState = "";
+    let lastActionableState = null;
+    let settled = false;
+    const stepTelemetry = createStepTelemetryTracker();
     actor.subscribe((snapshot) => {
-      const currentState = getStateName(snapshot);
-      const status = snapshot.status;
+      latestSnapshot = snapshot;
+      const activeStatePaths = getSnapshotStatePaths(snapshot);
+      stepTelemetry.transition(activeStatePaths);
+      const currentState = pickPrimaryStatePath(activeStatePaths, previousState) ?? activeStatePaths[0] ?? previousState ?? "unknown";
+      snapshot.status;
+      if (currentState && currentState !== "done" && currentState !== "failed" && !currentState.startsWith("finalize")) {
+        lastActionableState = currentState;
+      }
       if (currentState !== previousState) {
-        console.log(
-          `[DEBUG] State change: ${previousState} -> ${currentState} (status: ${status})`
-        );
-        handleProgressCommentUpdate(snapshot, previousState);
+        handleProgressCommentUpdate(snapshot, previousState, currentState, activeStatePaths);
         onStateChange?.(snapshot, previousState, logger);
         previousState = currentState;
       }
-      if (isComplete(snapshot)) {
+      if (isComplete(snapshot) && !settled) {
+        settled = true;
+        stopProgressHeartbeat();
         const output = snapshot.output;
-        console.log(
-          `[DEBUG] Machine completed: state=${currentState}, status=${status}, exitCode=${output?.exitCode}`
-        );
         if (output) {
-          resolve(output);
+          void (async () => {
+            const steps = stepTelemetry.finalize({
+              context: snapshot.context,
+              succeeded: output.exitCode === 0,
+              failedStatePath: output.exitCode === 0 ? null : lastActionableState
+            });
+            const nextOutput = {
+              ...output,
+              steps
+            };
+            try {
+              const summaryPath = await persistSummary({
+                context: snapshot.context,
+                steps
+              });
+              if (summaryPath) {
+                nextOutput.summaryPath = summaryPath;
+              }
+            } catch (error) {
+              console.error(
+                `[DEBUG] Failed to persist CI summary: ${error instanceof Error ? error.message : String(error)}`
+              );
+            }
+            resolve(nextOutput);
+          })().catch(reject);
         }
       }
     });
@@ -9295,7 +10885,7 @@ var stateLogHandlers = {
     if (ctx.input.productionDatabaseUrl) {
       logger.info("Running: pg_dump (production) \u2192 psql (local)");
     } else {
-      logger.info("GH_DATABASE_URL_ADMIN / GH_DATABASE_URL not set, skipping");
+      logger.info("GH_DATABASE_URL_ADMIN not set, skipping");
     }
   },
   syncSchema: (ctx, logger) => {
@@ -9367,7 +10957,7 @@ function buildMachineInput(options) {
     executionMode: void 0,
     dbMode: void 0,
     // PRD: GH_DATABASE_URL_ADMIN = postgres role (DDL capable, for pg_dump)
-    productionDatabaseUrl: process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL,
+    productionDatabaseUrl: process.env.GH_DATABASE_URL_ADMIN,
     databaseUrl: process.env.DATABASE_URL,
     runtimeEnv: captureRuntimeEnv()
   };
@@ -9419,7 +11009,7 @@ var CiExecutionEnvSchema = z.enum(["github-actions", "local"]);
 var CiPhaseSchema = z.enum(["all", "test"]);
 var CiDbModeSchema = z.enum(["auto", "local"]);
 var RepoKindSchema = z.enum(["monorepo", "pj-repo", "unknown"]);
-var StepStatusSchema = z.enum(["passed", "failed", "skipped", "timeout"]);
+var StepStatusSchema = z.enum(["passed", "failed", "skipped", "killed", "timeout"]);
 var LayerStatusSchema = z.enum(["passed", "failed", "skipped", "timeout", "killed"]);
 z.object({
   // === Command ===
@@ -9487,6 +11077,12 @@ z.object({
   skipStaticChecks: z.boolean().optional(),
   /** Skip build */
   skipBuild: z.boolean().optional(),
+  /** Skip local Supabase start inside ci pr setup */
+  skipLocalDbStart: z.boolean().optional(),
+  /** Assume local Supabase is already ready and skip status polling */
+  assumeSupabaseReady: z.boolean().optional(),
+  /** Skip Playwright browser installation even when Layer 4 is selected */
+  skipPlaywrightInstall: z.boolean().optional(),
   /** CI optimization: skip DB codegen (TypeScript + Zod) during db sync */
   skipDbCodegen: z.boolean().optional(),
   /** Fail fast */
@@ -9526,6 +11122,8 @@ z.object({
 });
 z.object({
   passed: z.boolean(),
+  skipped: z.boolean().optional(),
+  skipReason: z.string().optional(),
   appDatabaseUrl: z.string().optional(),
   error: z.string().optional()
 });
@@ -9579,7 +11177,15 @@ var StepSummarySchema = z.object({
   status: StepStatusSchema,
   exitCode: z.number().int().optional(),
   logPath: z.string().optional(),
-  error: z.string().optional()
+  error: z.string().optional(),
+  reason: z.string().optional(),
+  title: z.string().optional(),
+  phase: z.enum(["setup", "github", "db", "observability", "build", "test", "finalize"]).optional(),
+  parentStep: z.string().optional(),
+  optional: z.boolean().optional(),
+  startedAt: z.string().optional(),
+  endedAt: z.string().optional(),
+  durationMs: z.number().int().nonnegative().optional()
 });
 var LayerSummarySchema = z.object({
   status: LayerStatusSchema,
@@ -9682,13 +11288,28 @@ function logPlan2(steps) {
     console.log("");
   }
 }
+function logSetupRolesStatus(ctx, logger) {
+  const setupRolesStep = ctx.stepOverrides["postSeedPr.execution.setupRoles"];
+  if (setupRolesStep?.status === "skipped") {
+    logger.info(`Database roles setup skipped: ${setupRolesStep.reason ?? "optional step"}`);
+    return;
+  }
+  if (ctx.rolesSetup) {
+    logger.success("Database roles configured");
+  }
+}
 var CI_PR_UNKNOWN_STATE_LOG_SKIP = /* @__PURE__ */ new Set(["decidePath", "done", "failed"]);
 var stateLogHandlers2 = {
   // ─── Setup Phase ───────────────────────────────────────────
   setup: (_ctx, _logger) => {
     logSection3("Setup: Resolving Environment");
   },
-  "setup.prLocal": (_ctx, logger) => {
+  "setup.prLocal": (ctx, logger) => {
+    if (shouldReusePreparedRuntime(ctx)) {
+      logSection3("Setup: PR + Prepared Local Runtime");
+      logger.info("Reusing workflow-prepared local Supabase instance...");
+      return;
+    }
     logSection3("Setup: PR + Local Supabase");
     logger.info("Starting local Supabase instance...");
   },
@@ -9721,7 +11342,7 @@ var stateLogHandlers2 = {
       logger.success("Seeds applied successfully");
     }
     logSection3("Database: Production Preview (dry-run)");
-    logger.info("Running: pnpm exec runa db apply production --check");
+    logger.info("Running: pnpm exec runa db apply production --check --compare-only");
   },
   "postSeedPr.observability.collectSchemaStats": (ctx, logger) => {
     if (ctx.productionPreview?.executed) {
@@ -9735,9 +11356,7 @@ var stateLogHandlers2 = {
     logger.info("Comparing Local/CI/Production schemas...");
   },
   "postSeedPr.execution.staticChecks": (ctx, logger) => {
-    if (ctx.rolesSetup) {
-      logger.success("Database roles configured");
-    }
+    logSetupRolesStatus(ctx, logger);
     logSection3("Static Checks: type-check + lint (parallel)");
     logger.info("Running: pnpm type-check || pnpm lint");
   },
@@ -9745,6 +11364,11 @@ var stateLogHandlers2 = {
     if (ctx.staticChecksPassed) {
       logger.success("Static checks passed");
     }
+    if (shouldReusePreparedPlaywright(ctx)) {
+      logSection3("Build: App Build + Reuse Prepared Playwright");
+      logger.info("Running: pnpm build (Playwright install owned by outer workflow)");
+      return;
+    }
     logSection3("Build: App Build + Playwright Install (parallel)");
     logger.info("Running: pnpm build || pnpm exec playwright install chromium");
   },
@@ -9754,6 +11378,8 @@ var stateLogHandlers2 = {
     }
     if (ctx.manifestGenerated) {
       logger.success("Manifest generated (Layer 3 ready)");
+    } else if (ctx.manifestGenerated === null) {
+      logger.info("Manifest generation skipped (optional)");
     } else if (ctx.manifestGenerated === false) {
       logger.warn("Manifest generation failed (Layer 3 may be skipped)");
     }
@@ -9785,7 +11411,7 @@ var stateLogHandlers2 = {
       logger.info("Seeds skipped (no seed files or already seeded)");
     }
     logSection3("Database: Production Preview (dry-run)");
-    logger.info("Running: pnpm exec runa db apply production --check");
+    logger.info("Running: pnpm exec runa db apply production --check --compare-only");
   },
   collectSchemaStats: (ctx, logger) => {
     if (ctx.productionPreview?.executed) {
@@ -9807,9 +11433,7 @@ var stateLogHandlers2 = {
   },
   // ─── Static Analysis Phase ─────────────────────────────────
   staticChecks: (ctx, logger) => {
-    if (ctx.rolesSetup) {
-      logger.success("Database roles configured");
-    }
+    logSetupRolesStatus(ctx, logger);
     logSection3("Static Checks: type-check + lint (parallel)");
     logger.info("Running: pnpm type-check || pnpm lint");
   },
@@ -9818,6 +11442,11 @@ var stateLogHandlers2 = {
     if (ctx.staticChecksPassed) {
       logger.success("Static checks passed");
     }
+    if (shouldReusePreparedPlaywright(ctx)) {
+      logSection3("Build: App Build + Reuse Prepared Playwright");
+      logger.info("Running: pnpm build (Playwright install owned by outer workflow)");
+      return;
+    }
     logSection3("Build: App Build + Playwright Install (parallel)");
     logger.info("Running: pnpm build || pnpm exec playwright install chromium");
   },
@@ -9827,6 +11456,8 @@ var stateLogHandlers2 = {
     }
     if (ctx.manifestGenerated) {
       logger.success("Manifest generated (Layer 3 ready)");
+    } else if (ctx.manifestGenerated === null) {
+      logger.info("Manifest generation skipped (optional)");
     } else if (ctx.manifestGenerated === false) {
       logger.warn("Manifest generation failed (Layer 3 may be skipped)");
     }
@@ -9928,8 +11559,7 @@ function getGitHubEventAction() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
   if (!eventPath) return void 0;
   try {
-    const fs2 = __require("fs");
-    const eventPayload = JSON.parse(fs2.readFileSync(eventPath, "utf-8"));
+    const eventPayload = JSON.parse(readFileSync(eventPath, "utf-8"));
     return eventPayload.action;
   } catch {
     return void 0;
@@ -9945,6 +11575,9 @@ function optionsToMachineInput(options) {
     phase: options.phase,
     skipStaticChecks: options.skipStaticChecks,
     skipBuild: options.skipBuild,
+    skipLocalDbStart: options.skipLocalDbStart,
+    assumeSupabaseReady: options.assumeSupabaseReady,
+    skipPlaywrightInstall: options.skipPlaywrightInstall,
     skipDbCodegen: options.skipDbCodegen,
     failFast: options.failFast,
     maxWaitSeconds: options.maxWaitSeconds,
@@ -9955,9 +11588,9 @@ function optionsToMachineInput(options) {
     targetDir: process.cwd(),
     layers: [1, 2, 3, 4],
     // Environment capture (Environment Capture Pattern: capture at entry point, not in machine/guards)
-    databaseUrl: process.env.DATABASE_URL,
+    databaseUrl: options.databaseUrl ?? process.env.DATABASE_URL,
     // PRD: GH_DATABASE_URL_ADMIN = postgres role (DDL capable, for pg-schema-diff dry-run)
-    productionDatabaseUrl: process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL,
+    productionDatabaseUrl: process.env.GH_DATABASE_URL_ADMIN,
     runtimeEnv: captureRuntimeEnv(),
     githubRef: process.env.GITHUB_REF,
     // FIX: Read action from GITHUB_EVENT_PATH JSON, not non-existent GITHUB_EVENT_ACTION env var
@@ -9980,16 +11613,33 @@ async function runCiPrCommand(options) {
   const logger = createCLILogger("ci:pr");
   const skipStaticChecks = options.skipStaticChecks === true;
   const skipBuild = options.skipBuild === true;
+  const phase = options.phase ?? "all";
+  const testOnlyPhase = phase === "test";
+  const preparedRuntime = options.skipLocalDbStart === true || options.assumeSupabaseReady === true;
+  const preparedPlaywright = options.skipPlaywrightInstall === true;
   const planSteps = [
-    { id: "setup", description: "Start local Supabase instance" },
     {
-      id: "db",
-      description: "db apply \u2192 db seed \u2192 (production preview \u2225 schema stats \u2225 db:setup-roles)"
+      id: "setup",
+      description: testOnlyPhase ? "Resolve repo/app context (optionally reuse pre-started local Supabase)" : preparedRuntime ? "Reuse workflow-prepared local Supabase runtime" : "Start local Supabase instance"
     },
+    ...testOnlyPhase ? [{ id: "db", description: "Skip schema apply/seed and reuse the prepared database" }] : [
+      {
+        id: "db",
+        description: "db apply \u2192 db seed \u2192 (production preview \u2225 schema stats \u2225 db:setup-roles)"
+      }
+    ],
     ...skipStaticChecks ? [] : [{ id: "static", description: "pnpm type-check + pnpm lint (parallel)" }],
-    ...skipBuild ? [] : [{ id: "build", description: "pnpm build \u2192 manifest:generate + playwright install" }],
+    ...skipBuild ? [] : [
+      {
+        id: "build",
+        description: preparedPlaywright ? "pnpm build \u2192 manifest:generate (reuse preinstalled Playwright)" : "pnpm build \u2192 manifest:generate + playwright install"
+      }
+    ],
     { id: "test", description: "Start app \u2192 detect capabilities \u2192 run layers 1-4" },
-    { id: "finalize", description: "Write ci-summary.json + post GitHub comment" }
+    {
+      id: "finalize",
+      description: "Write ci-summary.json + post GitHub comment"
+    }
   ];
   logPlan2(planSteps);
   const machineInput = optionsToMachineInput(options);
@@ -10010,7 +11660,19 @@ async function runCiPrCommand(options) {
     await flushAndExit(1);
   }
 }
-var ciPrUnifiedCommand = new Command("pr").description("Run PR CI end-to-end (uses local Docker Supabase)").option("--mode <mode>", "Mode: github-actions | local").option("--output <output>", "Output: human | json").option("--config <path>", "Config path (defaults to .runa/ci.config.json if present)").option("--phase <phase>", "Phase: all | test", "all").option("--skip-static-checks", "Skip type-check and lint (assumes already executed)", false).option("--skip-build", "Skip build (advanced; only if app start does not require build)", false).option(
+var ciPrUnifiedCommand = new Command("pr").description("Run PR CI end-to-end (uses local Docker Supabase or workflow-prepared runtime)").option("--mode <mode>", "Mode: github-actions | local").option("--output <output>", "Output: human | json").option("--config <path>", "Config path (defaults to .runa/ci.config.json if present)").option("--database-url <url>", "Override local database URL (defaults to DATABASE_URL)").option("--phase <phase>", "Phase: all | blocking | observability | test", "all").option("--skip-static-checks", "Skip type-check and lint (assumes already executed)", false).option("--skip-build", "Skip build (advanced; only if app start does not require build)", false).option(
+  "--skip-local-db-start",
+  "Skip local Supabase start inside ci pr setup (for workflow-prepared environments)",
+  false
+).option(
+  "--assume-supabase-ready",
+  "Skip Supabase status polling and reuse configured local URLs/keys",
+  false
+).option(
+  "--skip-playwright-install",
+  "Skip Playwright browser installation even when Layer 4 is selected",
+  false
+).option(
   "--skip-db-codegen",
   "Skip DB codegen (drizzle introspect + zod) during db sync (recommended for CI preview)",
   false