@runa-ai/runa-cli 0.7.3 → 0.9.0

package/dist/{ci-Z4525QW6.js → ci-S5KSBECX.js}

@@ -1,25 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, detectAppSchemas, formatSchemasForSql } from './chunk-4XHZQRRK.js';
-import { isPathContained } from './chunk-DRSUEMAK.js';
+import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, isIdempotentRoleHazard, detectAppSchemas, formatSchemasForSql, getDbPlanArtifactPath, runDbApply } from './chunk-YRNQEJQW.js';
+import './chunk-WGRVAGSR.js';
+import './chunk-ZWDWFMOX.js';
+import './chunk-UHDAYPHH.js';
+import './chunk-Y5ANTCKE.js';
+import './chunk-IWVXI5O4.js';
+import './chunk-GKBE7EIE.js';
+import './chunk-B7C7CLW2.js';
 import './chunk-QDF7QXBL.js';
 import { getSnapshotStateName, getSnapshotStatePaths, isSnapshotComplete } from './chunk-XVNDDHAF.js';
-import { writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput } from './chunk-FWMGC5FP.js';
+import { createInitialSummary, resolveMode, appendGithubStepSummary, buildCiProdApplyStepSummaryMarkdown, setSummaryErrorFromUnknown, writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput, requireCiAutoApprove, resolveProdApplyInputs, parseIntOr, classifyCiProdApplyError, addGithubMask } from './chunk-EXR4J2JT.js';
+import './chunk-URWDB7YL.js';
 import { parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, psqlSyncQuery } from './chunk-A6A7JIRD.js';
-import { ensureRunaTmpDir, runLogged } from './chunk-6FAU4IGR.js';
+import { ensureRunaTmpDir, runLogged } from './chunk-ELXXQIGW.js';
 import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
 import { getSafeEnv, getFilteredEnv, redactSecrets } from './chunk-II7VYQEM.js';
 import { init_constants, init_local_supabase, detectLocalSupabasePorts } from './chunk-QSEF4T3Y.js';
 import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
 import './chunk-WJXC4MVY.js';
 import { setOutputFormat } from './chunk-HKUWEGUX.js';
-import { detectEnvironment } from './chunk-JMJP4A47.js';
-import { init_esm_shims, __require } from './chunk-VRXHCR5K.js';
+import './chunk-OERS32LW.js';
+import './chunk-GT5DMS5R.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { Command } from 'commander';
 import { spawnSync, spawn, execFileSync } from 'child_process';
-import { mkdir, writeFile, appendFile, readFile } from 'fs/promises';
+import { mkdir, writeFile, readFile } from 'fs/promises';
 import path4, { join } from 'path';
-import { CommandOutcomeSchema, createCLILogger, CLIError, syncFromProduction, formatDuration, GITHUB_API, getClassificationForProfile, isTimeoutLikeMessage, buildCommandOutcomeSummary, deriveCommandExitMode, getStatusIcon, detectDatabasePackage, DATABASE_PACKAGE_CANDIDATES } from '@runa-ai/runa';
+import { CommandOutcomeSchema, createCLILogger, CLIError, syncFromProduction, GITHUB_API, getClassificationForProfile, formatDuration, buildCommandOutcomeSummary, deriveCommandExitMode, getStatusIcon, DATABASE_PACKAGE_CANDIDATES, detectDatabasePackage } from '@runa-ai/runa';
 import { z } from 'zod';
 import { existsSync, createWriteStream, readFileSync, readdirSync, statSync, promises, lstatSync } from 'fs';
 import { resolve4 } from 'dns/promises';
@@ -28,6 +36,7 @@ import { fromPromise, setup, assign, createActor } from 'xstate';
 import { randomUUID, createHash } from 'crypto';
 import { execa } from 'execa';
 import postgres from 'postgres';
+import { resolveLayer4DiscoverySync } from '@runa-ai/runa/test-config';
 import { glob } from 'glob';
 
 createRequire(import.meta.url);
@@ -37,28 +46,6 @@ init_esm_shims();
 
 // src/commands/ci/commands/ci-checks.ts
 init_esm_shims();
-
-// src/commands/ci/utils/github.ts
-init_esm_shims();
-async function appendGithubStepSummary(markdown) {
-  const file = process.env.GITHUB_STEP_SUMMARY;
-  if (!file) return;
-  await appendFile(file, `${markdown.trimEnd()}
-
-`, "utf-8");
-}
-function addGithubMask(value) {
-  if (!value) return;
-  console.log(`::add-mask::${value}`);
-}
-z.object({
-  action: z.string().optional(),
-  pull_request: z.object({
-    number: z.number().int()
-  })
-}).passthrough();
-
-// src/commands/ci/commands/ci-checks.ts
 async function runTool(params) {
   const startTime = Date.now();
   return new Promise((resolve) => {
@@ -316,29 +303,30 @@ async function loadCiConfig(params) {
 
 // src/commands/ci/utils/ci-logging.ts
 init_esm_shims();
+var write = (msg) => process.stderr.write(msg + "\n");
 function logSection(title) {
-  console.log("");
-  console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
-  console.log(title);
-  console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
-  console.log("");
+  write("");
+  write("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+  write(title);
+  write("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+  write("");
 }
 function logKeyValueTable(params) {
   logSection(params.title);
   for (const [k, v] of params.rows) {
-    console.log(`${k}: ${v}`);
+    write(`${k}: ${v}`);
   }
 }
 function logPlan(steps) {
   logSection("Plan");
   for (const step of steps) {
-    console.log(`- ${step.id}: ${step.description}`);
+    write(`- ${step.id}: ${step.description}`);
   }
 }
 function logNextActions(items) {
   logSection("Next");
   for (const item of items) {
-    console.log(`- ${item}`);
+    write(`- ${item}`);
   }
 }
 
@@ -506,7 +494,7 @@ async function githubRequest(params) {
     url.searchParams.set(k, String(v));
   }
   const startTime = Date.now();
-  console.log(`[DEBUG] GitHub API: ${params.method} ${params.path} (starting)`);
+  process.stderr.write(`[DEBUG] GitHub API: ${params.method} ${params.path} (starting)`);
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), GITHUB_API_TIMEOUT_MS);
   try {
@@ -525,7 +513,7 @@ async function githubRequest(params) {
     const duration = Date.now() - startTime;
     if (!res.ok) {
       const text = await res.text().catch(() => "");
-      console.error(
+      process.stderr.write(
         `[DEBUG] GitHub API: ${params.method} ${params.path} failed (${res.status}) after ${duration}ms`
       );
       throw new CLIError(
@@ -536,7 +524,7 @@ async function githubRequest(params) {
         20
       );
     }
-    console.log(
+    process.stderr.write(
       `[DEBUG] GitHub API: ${params.method} ${params.path} succeeded (${res.status}) in ${duration}ms`
     );
     if (res.status === 204) return null;
@@ -546,7 +534,7 @@ async function githubRequest(params) {
     clearTimeout(timeoutId);
     const duration = Date.now() - startTime;
     if (error instanceof Error && error.name === "AbortError") {
-      console.error(
+      process.stderr.write(
         `[DEBUG] GitHub API: ${params.method} ${params.path} timed out after ${duration}ms`
       );
       throw new CLIError(
@@ -557,7 +545,7 @@ async function githubRequest(params) {
         21
       );
     }
-    console.error(
+    process.stderr.write(
       `[DEBUG] GitHub API: ${params.method} ${params.path} error after ${duration}ms: ${error instanceof Error ? error.message : String(error)}`
     );
     throw error;
@@ -684,17 +672,6 @@ async function detectStack(repoRoot, tmpDir, productionDbUrlAdmin) {
   });
   return String(res.stdout ?? "").trim();
 }
-function runGitDiffQuiet(repoRoot, diffPaths) {
-  const result = spawnSync("git", ["diff", "--quiet", "origin/main", "HEAD", "--", ...diffPaths], {
-    cwd: repoRoot,
-    stdio: "ignore",
-    timeout: 3e4
-  });
-  if (result.error || result.signal === "SIGTERM") {
-    return null;
-  }
-  return result.status !== 0;
-}
 function getSqlSchemaDiffPaths(repoRoot) {
   const declarativeSqlPath = path4.join(repoRoot, "supabase/schemas/declarative");
   const idempotentSqlPath = path4.join(repoRoot, "supabase/schemas/idempotent");
@@ -711,6 +688,38 @@ function getLegacySchemaDiffPath(repoRoot) {
   const schemaPath = path4.join(detected, "src", "schema");
   return existsSync(path4.join(repoRoot, schemaPath)) ? `${schemaPath}/` : null;
 }
+function resolveSchemaDiffTarget(repoRoot) {
+  const sqlDiffPaths = getSqlSchemaDiffPaths(repoRoot);
+  if (sqlDiffPaths.length > 0) {
+    return {
+      label: "git diff schema (supabase/schemas)",
+      paths: sqlDiffPaths
+    };
+  }
+  const legacySchemaPath = getLegacySchemaDiffPath(repoRoot);
+  if (legacySchemaPath) {
+    return {
+      label: "git diff schema (legacy drizzle schema)",
+      paths: [legacySchemaPath]
+    };
+  }
+  for (const candidate of DATABASE_PACKAGE_CANDIDATES) {
+    const candidatePath = path4.join("packages", candidate, "src", "schema");
+    if (existsSync(path4.join(repoRoot, candidatePath))) {
+      return {
+        label: `git diff schema (packages/${candidate})`,
+        paths: [`${candidatePath}/`]
+      };
+    }
+  }
+  if (existsSync(path4.join(repoRoot, "src", "schema"))) {
+    return {
+      label: "git diff schema (src/schema)",
+      paths: ["src/schema/"]
+    };
+  }
+  return null;
+}
 function checkIfInitialDeployment(repoRoot, productionDbUrl) {
   const schemasDir = path4.join(repoRoot, "supabase", "schemas", "declarative");
   let schemas;
@@ -777,71 +786,32 @@ function checkIfInitialDeployment(repoRoot, productionDbUrl) {
     };
   }
 }
-function hasSchemaChanges(repoRoot) {
-  const sqlDiffPaths = getSqlSchemaDiffPaths(repoRoot);
-  if (sqlDiffPaths.length > 0) {
-    return runGitDiffQuiet(repoRoot, sqlDiffPaths);
-  }
-  const legacySchemaPath = getLegacySchemaDiffPath(repoRoot);
-  if (legacySchemaPath) {
-    return runGitDiffQuiet(repoRoot, [legacySchemaPath]);
+async function collectSchemaChangeSummary(repoRoot, tmpDir) {
+  const target = resolveSchemaDiffTarget(repoRoot);
+  if (!target) {
+    return {
+      hasChanges: null,
+      diffLogPath: null,
+      targetLabel: null,
+      diffPaths: []
+    };
   }
-  return null;
-}
-async function showSchemaDiff(repoRoot, tmpDir) {
   const diffLog = path4.join(tmpDir, "schema-diff.log");
-  const safeEnv = getSafeEnv();
-  const declarativeSqlPath = path4.join(repoRoot, "supabase/schemas/declarative");
-  if (existsSync(declarativeSqlPath)) {
-    await runLogged({
-      cwd: repoRoot,
-      env: safeEnv,
-      label: "git diff schema (supabase/schemas/declarative)",
-      command: "git",
-      args: ["diff", "origin/main", "HEAD", "--", "supabase/schemas/declarative/"],
-      logFile: diffLog
-    });
-    return;
-  }
-  const detected = detectDatabasePackage(repoRoot);
-  if (detected) {
-    const schemaPath = path4.join(detected, "src", "schema");
-    if (existsSync(path4.join(repoRoot, schemaPath))) {
-      await runLogged({
-        cwd: repoRoot,
-        env: safeEnv,
-        label: `git diff schema (${detected})`,
-        command: "git",
-        args: ["diff", "origin/main", "HEAD", "--", `${schemaPath}/`],
-        logFile: diffLog
-      });
-      return;
-    }
-  }
-  for (const candidate of DATABASE_PACKAGE_CANDIDATES) {
-    const candidatePath = path4.join("packages", candidate, "src", "schema");
-    if (existsSync(path4.join(repoRoot, candidatePath))) {
-      await runLogged({
-        cwd: repoRoot,
-        env: safeEnv,
-        label: `git diff schema (packages/${candidate})`,
-        command: "git",
-        args: ["diff", "origin/main", "HEAD", "--", `${candidatePath}/`],
-        logFile: diffLog
-      });
-      return;
-    }
-  }
-  if (existsSync(path4.join(repoRoot, "src", "schema"))) {
-    await runLogged({
-      cwd: repoRoot,
-      env: safeEnv,
-      label: "git diff schema (src/schema)",
-      command: "git",
-      args: ["diff", "origin/main", "HEAD", "--", "src/schema/"],
-      logFile: diffLog
-    });
-  }
+  const diffResult = await runLogged({
+    cwd: repoRoot,
+    env: getSafeEnv(),
+    label: target.label,
+    command: "git",
+    args: ["diff", "origin/main", "HEAD", "--", ...target.paths],
+    logFile: diffLog
+  });
+  const rawDiff = String(diffResult.stdout ?? "");
+  return {
+    hasChanges: rawDiff.trim().length > 0,
+    diffLogPath: diffLog,
+    targetLabel: target.label,
+    diffPaths: target.paths
+  };
 }
 async function detectRisks(repoRoot, tmpDir, timeoutMs) {
   const logFile = path4.join(tmpDir, "db-risks.log");
@@ -859,8 +829,8 @@ async function detectRisks(repoRoot, tmpDir, timeoutMs) {
   } catch (error) {
     let logContent = "";
     try {
-      const { readFileSync: readFileSync5 } = await import('fs');
-      logContent = readFileSync5(logFile, "utf-8");
+      const { readFileSync: readFileSync4 } = await import('fs');
+      logContent = readFileSync4(logFile, "utf-8");
     } catch {
     }
     const isInitialDeployment = logContent.includes("No common ancestor") || logContent.includes("INITIAL DEPLOYMENT");
@@ -909,15 +879,12 @@ async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin, tim
     timeoutMs
   });
 }
-function parseApplyLog(logContent) {
-  const hazards = [];
+function summarizePlanSql(sql) {
   let statements = 0;
   const changes = [];
-  let retryAttempts;
-  let retryWaitMs;
-  const createMatches = logContent.match(/CREATE\s+(TABLE|INDEX|POLICY|FUNCTION|TRIGGER)/gi);
-  const alterMatches = logContent.match(/ALTER\s+(TABLE|COLUMN|POLICY)/gi);
-  const dropMatches = logContent.match(/DROP\s+(TABLE|INDEX|POLICY|FUNCTION|TRIGGER)/gi);
+  const createMatches = sql.match(/CREATE\s+(TABLE|INDEX|POLICY|FUNCTION|TRIGGER)/gi);
+  const alterMatches = sql.match(/ALTER\s+(TABLE|COLUMN|POLICY)/gi);
+  const dropMatches = sql.match(/DROP\s+(TABLE|INDEX|POLICY|FUNCTION|TRIGGER)/gi);
   const creates = createMatches?.length ?? 0;
   const alters = alterMatches?.length ?? 0;
   const drops = dropMatches?.length ?? 0;
@@ -925,87 +892,123 @@ function parseApplyLog(logContent) {
   if (creates > 0) changes.push(`${creates} CREATE`);
   if (alters > 0) changes.push(`${alters} ALTER`);
   if (drops > 0) changes.push(`${drops} DROP`);
-  const hazardSet = /* @__PURE__ */ new Set();
-  const hazardMatches = logContent.matchAll(/-- Hazard (\w+): (.+)/g);
-  for (const match of hazardMatches) {
-    hazardSet.add(`${match[1]}: ${match[2]}`);
-  }
-  hazards.push(...hazardSet);
-  const retryMatch = logContent.match(/Retry (\d+)\/(\d+) after (\d+)ms/g);
-  if (retryMatch) {
-    retryAttempts = retryMatch.length;
-    const waitMatches = logContent.matchAll(/after (\d+)ms/g);
-    retryWaitMs = 0;
-    for (const m of waitMatches) {
-      retryWaitMs += Number.parseInt(m[1], 10);
-    }
+  if (!sql.trim()) {
+    return { statements: 0, summary: "No schema changes" };
   }
-  const metricsMatch = logContent.match(/retries=(\d+)/);
-  if (metricsMatch) {
-    retryAttempts = Number.parseInt(metricsMatch[1], 10);
+  const summary = changes.length > 0 ? changes.join(", ") : "Schema applied";
+  return { statements, summary };
+}
+function summarizeApplyResult(result) {
+  const sql = result.filteredPlanSql ?? result.planSql ?? "";
+  const summaryFromSql = summarizePlanSql(sql);
+  const statements = result.planSummary?.effectiveStatements ?? summaryFromSql.statements;
+  if (!sql.trim() || statements === 0 || result.planner?.hasChanges === false) {
+    return {
+      statements: 0,
+      summary: "No schema changes"
+    };
   }
-  if (logContent.toLowerCase().includes("no schema changes detected")) {
-    return { statements: 0, hazards: [], summary: "No schema changes", retryAttempts, retryWaitMs };
+  if (summaryFromSql.summary !== "Schema applied") {
+    return {
+      statements,
+      summary: summaryFromSql.summary
+    };
   }
-  const summary = changes.length > 0 ? changes.join(", ") : "Schema applied";
-  return { statements, hazards, summary, retryAttempts, retryWaitMs };
+  return {
+    statements,
+    summary: `${statements} structural statement${statements === 1 ? "" : "s"} applied`
+  };
 }
-async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, productionDbUrl, options) {
-  const args = [
-    "exec",
-    "runa",
-    "db",
-    "apply",
-    "production",
-    "--auto-approve",
-    "--no-seed",
-    "--verbose"
-  ];
-  if (options?.allowDataLoss) {
-    args.push("--allow-data-loss");
+async function withTemporaryEnv(overrides, run) {
+  const previous = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(overrides)) {
+    previous.set(key, process.env[key]);
+    if (value === void 0) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await run();
+  } finally {
+    for (const [key, value] of previous.entries()) {
+      if (value === void 0) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
   }
-  if (options?.confirmAuthzUpdate) {
-    args.push("--confirm-authz-update");
+}
+async function withTimeout(promise, timeoutMs, label) {
+  if (!timeoutMs || timeoutMs <= 0) {
+    return promise;
   }
-  if (options?.maxLockWaitMs !== void 0) {
-    args.push("--max-lock-wait-ms", String(options.maxLockWaitMs));
+  let timer;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          reject(new Error(`${label} timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        timer.unref?.();
+      })
+    ]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
   }
-  const logPath = path4.join(tmpDir, "db-apply-production.log");
+}
+async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, productionDbUrl, options) {
+  const logPath = path4.join(tmpDir, "db-apply-production.json");
   const startTime = Date.now();
-  await runLogged({
-    cwd: repoRoot,
-    env: {
+  const plannerArtifactPath = getDbPlanArtifactPath({
+    repoRoot,
+    environment: "production",
+    previewProfile: "full"
+  });
+  const result = await withTemporaryEnv(
+    {
       ...getFilteredEnv(),
-      // PRD Naming Convention:
-      // - GH_DATABASE_URL_ADMIN = postgres role (DDL capable, for pg-schema-diff)
-      // - GH_DATABASE_URL = drizzle_app role (app runtime)
       GH_DATABASE_URL_ADMIN: productionDbUrlAdmin,
       GH_DATABASE_URL: productionDbUrl || productionDbUrlAdmin
     },
-    label: "db apply production",
-    command: "pnpm",
-    args,
-    logFile: logPath,
-    timeoutMs: options?.timeoutMs
-  });
-  const totalMs = Date.now() - startTime;
-  let logContent = "";
-  try {
-    const { readFileSync: readFileSync5 } = await import('fs');
-    logContent = readFileSync5(logPath, "utf-8");
-  } catch {
+    () => withTimeout(
+      runDbApply("production", {
+        verbose: true,
+        seed: false,
+        autoApprove: true,
+        allowDataLoss: options?.allowDataLoss,
+        confirmAuthzUpdate: options?.confirmAuthzUpdate,
+        maxLockWaitMs: options?.maxLockWaitMs,
+        commandLabel: `runa db apply production --from-plan ${path4.relative(repoRoot, plannerArtifactPath)}`,
+        fromPlan: plannerArtifactPath
+      }),
+      options?.timeoutMs,
+      "db apply production"
+    )
+  );
+  await writeFile(logPath, `${JSON.stringify(result, null, 2)}
+`, "utf-8");
+  if (result.error) {
+    throw new Error(result.error);
   }
-  const parsed = parseApplyLog(logContent);
+  const totalMs = Date.now() - startTime;
+  const parsed = summarizeApplyResult(result);
   return {
     statementsExecuted: parsed.statements,
-    hazards: parsed.hazards,
+    hazards: result.hazards,
     changeSummary: parsed.summary,
     logPath,
     metrics: {
-      totalMs,
-      retryAttempts: parsed.retryAttempts,
-      retryWaitMs: parsed.retryWaitMs
-    }
+      totalMs: result.metrics?.totalMs ?? totalMs,
+      retryAttempts: result.metrics?.retryAttempts,
+      retryWaitMs: result.metrics?.retryWaitMs
+    },
+    planner: result.planner
   };
 }
 async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
@@ -1019,30 +1022,17 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
     logFile: path4.join(tmpDir, "git-commit-message.log")
   });
   const commitMsg = String(msg.stdout ?? "").trim();
-  const schemaPaths = [];
-  const declarativeSqlPath = path4.join(repoRoot, "supabase/schemas/declarative");
-  if (existsSync(declarativeSqlPath)) {
-    schemaPaths.push("supabase/schemas/declarative/");
-  } else {
-    const detected = detectDatabasePackage(repoRoot);
-    if (detected) {
-      schemaPaths.push(`${detected}/src/schema/`);
-    } else {
-      for (const candidate of DATABASE_PACKAGE_CANDIDATES) {
-        schemaPaths.push(`packages/${candidate}/src/schema/`);
-      }
-      schemaPaths.push("src/schema/");
-    }
-  }
-  const diff = await runLogged({
-    cwd: repoRoot,
-    env: safeEnv,
-    label: "git diff (schema)",
-    command: "git",
-    args: ["diff", "origin/main", "HEAD", "--", ...schemaPaths],
-    logFile: path4.join(tmpDir, "git-schema-diff.log")
-  });
-  const diffRaw = String(diff.stdout ?? "");
+  const target = resolveSchemaDiffTarget(repoRoot);
+  const diffRaw = target ? String(
+    (await runLogged({
+      cwd: repoRoot,
+      env: safeEnv,
+      label: target.label,
+      command: "git",
+      args: ["diff", "origin/main", "HEAD", "--", ...target.paths],
+      logFile: path4.join(tmpDir, "git-schema-diff.log")
+    })).stdout ?? ""
+  ) : "";
   const diffLimited = diffRaw.length > 1e4 ? diffRaw.slice(0, 1e4) : diffRaw;
   await runLogged({
     cwd: repoRoot,
@@ -1102,6 +1092,24 @@ async function notifyDeployment(repoRoot, tmpDir, params) {
 }
 
 // src/commands/ci/commands/ci-prod-github.ts
+function formatPlannerSource(result) {
+  const planner = result.planner;
+  if (!planner) return null;
+  if (planner.source === "artifact") {
+    return "Reused checked full preview artifact";
+  }
+  if (planner.reuseAttempted) {
+    return "Inline planning after checked artifact fallback";
+  }
+  return "Inline planning";
+}
+function formatPlannerFallback(result) {
+  const planner = result.planner;
+  if (!planner?.reuseAttempted || planner.source === "artifact" || !planner.reuseReason) {
+    return null;
+  }
+  return planner.reuseMessage ? `${planner.reuseReason}: ${planner.reuseMessage}` : planner.reuseReason;
+}
 async function maybeNotifyExternal(params) {
   if (params.skipNotify) return;
   const runaAppUrl = process.env.RUNA_APP_URL?.trim() || "";
@@ -1142,6 +1150,17 @@ async function maybeAddGithubLabelAndComment(params) {
     if (result.statementsExecuted > 0) {
       changeSummaryLines.push(`- **Statements executed**: ${result.statementsExecuted}`);
     }
+    const plannerSource = formatPlannerSource(result);
+    if (plannerSource) {
+      changeSummaryLines.push(`- **Plan source**: ${plannerSource}`);
+    }
+    const plannerFallback = formatPlannerFallback(result);
+    if (plannerFallback) {
+      changeSummaryLines.push(`- **Plan reuse fallback**: ${plannerFallback}`);
+    }
+    if (result.planner?.hasChanges === false) {
+      changeSummaryLines.push("- **Plan result**: No schema changes");
+    }
     if (result.hazards.length > 0) {
       const hazardList = result.hazards.map((h) => `  - ${h}`).join("\n");
       changeSummaryLines.push(`- **Hazards**:
@@ -1194,135 +1213,6 @@ async function maybePostFailureComment(params) {
   }
 }
 
-// src/commands/ci/commands/ci-prod-utils.ts
-init_esm_shims();
-function requireEnv(name) {
-  const v = process.env[name];
-  if (v && v.trim().length > 0) return v.trim();
-  throw new CLIError(
-    `Missing required environment variable: ${name}`,
-    "CI_INPUT_MISSING",
-    [`Set ${name} in GitHub Actions secrets/env`, "If unsure, run: runa check"],
-    void 0,
-    10
-  );
-}
-function resolveRepoKind() {
-  const env = detectEnvironment(process.cwd());
-  const result = env === "runa-repo" ? "monorepo" : env === "pj-repo" ? "pj-repo" : "unknown";
-  if (process.env.RUNA_DEBUG === "true") {
-    console.error("[DEBUG:resolveRepoKind]", {
-      cwd: process.cwd(),
-      detectedEnv: env,
-      result
-    });
-  }
-  return result;
-}
-function createInitialSummary(params) {
-  return {
-    version: "1.0",
-    mode: params.mode,
-    command: "ci prod-apply",
-    status: "failure",
-    startedAt: params.startedAt.toISOString(),
-    endedAt: params.startedAt.toISOString(),
-    durationMs: 0,
-    repoKind: resolveRepoKind(),
-    detected: {},
-    diagnostics: {},
-    steps: {},
-    layers: {},
-    errors: []
-  };
-}
-function requireCiAutoApprove(params) {
-  if (params.mode !== "github-actions") return;
-  if (params.autoApprove === true) return;
-  throw new CLIError(
-    "Missing required flag: --auto-approve (required in CI mode)",
-    "CI_AUTO_APPROVE_REQUIRED",
-    ["Re-run with: runa ci prod-apply --auto-approve", "Keep CI non-interactive and deterministic"],
-    void 0,
-    10
-  );
-}
-function resolveProdApplyInputs() {
-  const productionDatabaseUrlAdmin = requireEnv("GH_DATABASE_URL_ADMIN");
-  const productionDatabaseUrl = requireEnv("GH_DATABASE_URL");
-  addGithubMask(productionDatabaseUrlAdmin);
-  addGithubMask(productionDatabaseUrl);
-  return {
-    productionDatabaseUrlAdmin,
-    productionDatabaseUrl,
-    githubSha: process.env.GITHUB_SHA ?? "unknown",
-    githubActor: process.env.GITHUB_ACTOR ?? "unknown",
-    githubRepository: process.env.GITHUB_REPOSITORY ?? "unknown"
-  };
-}
-function setSummaryErrorFromUnknown(summary, error) {
-  if (error instanceof CLIError) {
-    summary.errors.push({
-      code: error.code ?? "CI_ERROR",
-      message: error.message,
-      step: "ci prod-apply",
-      details: error.cause instanceof Error ? error.cause.message : void 0
-    });
-    return;
-  }
-  if (error instanceof Error) {
-    summary.errors.push({ code: "CI_ERROR", message: error.message, step: "ci prod-apply" });
-    return;
-  }
-  summary.errors.push({ code: "CI_ERROR", message: String(error), step: "ci prod-apply" });
-}
-function buildCiProdApplyStepSummaryMarkdown(params) {
-  const { summary } = params;
-  const lines = [];
-  const statusEmoji = summary.status === "success" ? "\u2705" : "\u274C";
-  const duration = formatDuration(summary.durationMs);
-  lines.push(
-    `## ${statusEmoji} Production Deploy ${summary.status === "success" ? "Completed" : "Failed"}`
-  );
-  lines.push("");
-  lines.push(`**Duration**: ${duration}`);
-  lines.push("");
-  if (summary.dbOutcome) {
-    lines.push(`**Exit mode**: \`${summary.dbOutcome.exitMode}\``);
-    const failedPhase = summary.dbOutcome.phases.find(
-      (phase) => phase.status === "failed" || phase.status === "timeout"
-    );
-    if (failedPhase) {
-      lines.push(`**Failed phase**: \`${failedPhase.id}\``);
-    }
-    if (summary.dbOutcome.summary.warnings > 0) {
-      lines.push(`**Warnings**: ${summary.dbOutcome.summary.warnings}`);
-    }
-    lines.push("");
-  }
-  if (summary.errors.length > 0) {
-    lines.push("### \u274C Errors");
-    lines.push("");
-    for (const e of summary.errors) {
-      lines.push(`- **${e.code}**: ${e.message}`);
-    }
-    lines.push("");
-  }
-  lines.push("<details>");
-  lines.push("<summary>\u{1F4CB} Technical Details</summary>");
-  lines.push("");
-  lines.push(`- Command: \`${summary.command}\``);
-  lines.push(`- Mode: \`${summary.mode}\``);
-  lines.push(`- Summary: \`${params.summaryPath}\``);
-  if (summary.dbOutcome) {
-    lines.push(`- DB exit mode: \`${summary.dbOutcome.exitMode}\``);
-  }
-  lines.push("");
-  lines.push("</details>");
-  lines.push("");
-  return lines.join("\n");
-}
-
 // src/commands/ci/commands/ci-prod-workflow.ts
 init_esm_shims();
 
@@ -1523,8 +1413,8 @@ var CiProdApplyWorkflow = class {
         id: "schema-diff",
         description: "Show schema diff",
         run: async (ctx) => {
-          await showSchemaDiff(ctx.repoRoot, ctx.tmpDir);
-          ctx.hasSchemaChanges = hasSchemaChanges(ctx.repoRoot);
+          ctx.schemaChangeSummary = await collectSchemaChangeSummary(ctx.repoRoot, ctx.tmpDir);
+          ctx.hasSchemaChanges = ctx.schemaChangeSummary.hasChanges;
           if (ctx.hasSchemaChanges === false) {
             ctx.logger.info("No schema changes detected \u2014 schema apply steps will be skipped");
           } else if (ctx.hasSchemaChanges === null) {
@@ -1621,6 +1511,17 @@ var CiProdApplyWorkflow = class {
                 timeoutMs: ctx.options.applyTimeoutMs
               }
             );
+            if (ctx.schemaApplyResult.planner) {
+              ctx.summary.detected.dbPlanSource = ctx.schemaApplyResult.planner.source;
+              ctx.summary.detected.dbPlanArtifactPath = ctx.schemaApplyResult.planner.path;
+              ctx.summary.detected.dbPlanReuseAttempted = ctx.schemaApplyResult.planner.reuseAttempted;
+              ctx.summary.detected.dbPlanReuseReason = ctx.schemaApplyResult.planner.reuseReason;
+              ctx.summary.detected.dbPlanReuseMessage = ctx.schemaApplyResult.planner.reuseMessage;
+              ctx.summary.detected.dbPlanHasChanges = ctx.schemaApplyResult.planner.hasChanges;
+              ctx.summary.detected.dbSourceFingerprint = ctx.schemaApplyResult.planner.sourceFingerprint;
+              ctx.summary.detected.dbTargetFingerprint = ctx.schemaApplyResult.planner.targetFingerprint;
+              ctx.summary.detected.dbTargetFingerprintMatched = ctx.schemaApplyResult.planner.targetFingerprintMatched;
+            }
           } catch (error) {
             ctx.logger.error("Schema apply failed; attempting rollback from snapshot");
             await snapshotRestoreLatest(
@@ -1712,18 +1613,18 @@ var CiProdApplyWorkflow = class {
         console.log(`${prefix} done (${duration}ms)`);
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        const timeoutLike = isTimeoutLikeMessage(message);
+        const classified = classifyCiProdApplyError(error);
         phases.push({
           id: step.id,
           label: step.description,
-          status: timeoutLike ? "timeout" : "failed",
+          status: classified.retryable ? "timeout" : "failed",
           startedAt: new Date(startedAt).toISOString(),
           endedAt: (/* @__PURE__ */ new Date()).toISOString(),
           durationMs: Date.now() - startedAt,
           error: {
-            code: timeoutLike ? "PHASE_TIMEOUT" : "CI_PROD_APPLY_FAILED",
+            code: classified.code === "CI_ERROR" ? "CI_PROD_APPLY_FAILED" : classified.code,
             message,
-            retryable: timeoutLike,
+            retryable: classified.retryable,
             phase: step.id
           }
         });
@@ -1756,22 +1657,6 @@ var CiProdApplyWorkflow = class {
   }
 };
 
-// src/commands/ci/commands/ci-resolvers.ts
-init_esm_shims();
-
-// src/commands/ci/utils/config-readers.ts
-init_esm_shims();
-
-// src/commands/ci/commands/ci-resolvers.ts
-function resolveMode(modeRaw) {
-  if (modeRaw === "github-actions" || modeRaw === "local") return modeRaw;
-  return process.env.GITHUB_ACTIONS === "true" ? "github-actions" : "local";
-}
-function parseIntOr(value, fallback) {
-  const n = Number.parseInt(String(value ?? ""), 10);
-  return Number.isNaN(n) ? fallback : n;
-}
-
 // src/commands/ci/utils/workflow-idempotency.ts
 init_esm_shims();
 var PROD_DEPLOY_LOCK_ID = 88889;
@@ -1878,7 +1763,7 @@ function guardProductionDeployment(dbUrl, commit) {
     };
   }
   if (!idempotencyResult.checkSuccessful && idempotencyResult.error) {
-    console.warn(
+    process.stderr.write(
       `[WARN] Idempotency check failed: ${idempotencyResult.error}. Proceeding with deployment.`
     );
   }
@@ -2029,7 +1914,7 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
     console.log(`status: ${summary.status}`);
     console.log(`summary: ${path4.relative(repoRoot, summaryPath)}`);
     logNextActions([
-      "Inspect .runa/tmp logs (db-apply-production.log, snapshot-*.log)",
+      "Inspect .runa/tmp artifacts (db-apply-production.json, snapshot-*.log)",
       "If rollback succeeded, database should be restored to pre-deploy snapshot"
     ]);
     await appendGithubStepSummary(
@@ -4170,6 +4055,7 @@ function buildSkipResult(hasUrl) {
   return {
     preview: {
       executed: false,
+      profile: null,
       planSql: null,
       hazards: [],
       hasChanges: false,
@@ -4256,41 +4142,6 @@ function extractSqlFromSchemaChanges(fullOutput) {
   }
   return null;
 }
-function getIdempotentRoleNames(repoRoot) {
-  const idempotentDir = path4.join(repoRoot, "supabase", "schemas", "idempotent");
-  const roles = [];
-  try {
-    if (!existsSync(idempotentDir)) return [];
-    const files = readdirSync(idempotentDir).filter((f) => f.endsWith(".sql"));
-    for (const file of files) {
-      const content = readFileSync(path4.join(idempotentDir, file), "utf-8");
-      const roleMatches = content.matchAll(/CREATE\s+ROLE\s+(\w+)\s+WITH/gi);
-      for (const match of roleMatches) {
-        if (match[1]) roles.push(match[1].toLowerCase());
-      }
-      const existsMatches = content.matchAll(/rolname\s*=\s*'(\w+)'/gi);
-      for (const match of existsMatches) {
-        if (match[1] && !roles.includes(match[1].toLowerCase())) {
-          roles.push(match[1].toLowerCase());
-        }
-      }
-    }
-  } catch {
-  }
-  return [...new Set(roles)];
-}
-function isIdempotentRoleHazard(hazardType, hazardMessage, causingSql, idempotentRoles) {
-  if (hazardType.toUpperCase() !== "AUTHZ_UPDATE") return false;
-  if (idempotentRoles.length === 0) return false;
-  const sql = (causingSql || "").trim().toLowerCase();
-  const isGrantRevoke = /^\s*(?:grant|revoke)\b/i.test(sql);
-  if (sql && !isGrantRevoke) return false;
-  const textToCheck = sql || hazardMessage.toLowerCase();
-  for (const role of idempotentRoles) {
-    if (textToCheck.includes(role)) return true;
-  }
-  return false;
-}
 function getHazardSeverity(type) {
   switch (type.toUpperCase()) {
     case "DELETES_DATA":
@@ -4332,20 +4183,26 @@ function createHazardDetail(type, message, causingSql) {
     causingSql
   };
 }
-function collectCommentHazards(lines, idempotentRoles) {
+function collectCommentHazards(lines, schemasDir) {
   const hazards = [];
   for (let i = 0; i < lines.length; i++) {
     const parsed = parseHazardLine(lines[i] ?? "");
     if (!parsed) continue;
     const causingSql = findCausingSqlLine(lines, i);
-    if (isIdempotentRoleHazard(parsed.type, parsed.message, causingSql, idempotentRoles)) {
+    const registryHazard = {
+      type: parsed.type,
+      message: parsed.message,
+      fullMatch: lines[i] ?? "",
+      causingSql
+    };
+    if (isIdempotentRoleHazard(registryHazard, schemasDir)) {
       continue;
     }
     hazards.push(createHazardDetail(parsed.type, parsed.message, causingSql));
   }
   return hazards;
 }
-function appendEmojiHazards(fullOutput, idempotentRoles, hazards) {
+function appendEmojiHazards(fullOutput, schemasDir, hazards) {
   const hazardPrefixes = ["\u{1F534}", "\u{1F7E0}", "\u{1F7E1}", "\u26A0"];
   for (const line of fullOutput.split("\n")) {
     const trimmed = line.trim();
@@ -4356,7 +4213,12 @@ function appendEmojiHazards(fullOutput, idempotentRoles, hazards) {
     if (!match?.[1] || !match[2]) continue;
     const type = match[1].toUpperCase();
     const message = match[2].trim();
-    if (isIdempotentRoleHazard(type, message, void 0, idempotentRoles)) {
+    const registryHazard = {
+      type,
+      message,
+      fullMatch: trimmed
+    };
+    if (isIdempotentRoleHazard(registryHazard, schemasDir)) {
       continue;
     }
     const isDuplicate = hazards.some(
@@ -4369,9 +4231,9 @@ function appendEmojiHazards(fullOutput, idempotentRoles, hazards) {
 }
 function extractHazardsWithContext(fullOutput, repoRoot) {
   const lines = fullOutput.split("\n");
-  const idempotentRoles = repoRoot ? getIdempotentRoleNames(repoRoot) : [];
-  const hazards = collectCommentHazards(lines, idempotentRoles);
-  appendEmojiHazards(fullOutput, idempotentRoles, hazards);
+  const schemasDir = repoRoot ? path4.join(repoRoot, "supabase", "schemas", "declarative") : void 0;
+  const hazards = collectCommentHazards(lines, schemasDir);
+  appendEmojiHazards(fullOutput, schemasDir, hazards);
   return hazards;
 }
 function stripAnsi(text) {
@@ -4388,6 +4250,7 @@ var PreviewOutputSchema = z.object({
   filteredPlanSql: z.string().optional(),
   hazards: z.array(z.string()),
   checkOnly: z.boolean().optional(),
+  previewProfile: z.enum(["compare-only", "full"]).optional(),
   metrics: z.object({
     totalMs: z.number(),
     idempotentMs: z.number().optional(),
@@ -4411,6 +4274,7 @@ function tryParseStructuredOutput(stdout) {
       hazards: data.hazards,
       hasChanges,
       checkOnly: data.checkOnly ?? false,
+      previewProfile: data.previewProfile ?? null,
       metrics: data.metrics
     };
   } catch {
@@ -4526,6 +4390,7 @@ function buildErrorResult(error, databaseUrl) {
   return {
     preview: {
       executed: true,
+      profile: null,
       planSql: null,
       hazards: [],
       hasChanges: false,
@@ -4541,6 +4406,7 @@ function buildPreviewFromOutput(stdout, _stderr, fullOutput, repoRoot, productio
       hazards: structured.hazards,
       hazardDetails: void 0,
       hasChanges: structured.hasChanges,
+      profile: structured.previewProfile,
       error: null
     };
   }
@@ -4560,6 +4426,7 @@ function buildPreviewFromOutput(stdout, _stderr, fullOutput, repoRoot, productio
     hazards,
     hazardDetails: hazardDetails.length > 0 ? hazardDetails : void 0,
     hasChanges,
+    profile: null,
     error: enhanceConnectionError(rawError, productionUrl)
   };
 }
@@ -4573,6 +4440,7 @@ function buildSuccessPreviewResult(exitCode, stdout, stderr, fullOutput, repoRoo
       hazards: preview.hazards,
       hazardDetails: preview.hazardDetails,
       hasChanges: preview.hasChanges,
+      profile: preview.profile ?? null,
       error: isSuccess ? null : preview.error
     }
   };
@@ -4586,9 +4454,11 @@ var productionPreviewActor = fromPromise(
     }
     const logFile = path4.join(tmpDir, "ci-production-preview.log");
     const timeoutMs = resolveProductionPreviewTimeoutMs();
-    console.log("\u25B6 production preview (dry-run): runa db apply production --check --compare-only");
     console.log(
-      "\u25B6 production preview details: pg-schema-diff plan + hazard extraction (compare-only)"
+      "\u25B6 production preview (dry-run): runa db preview production --profile compare-only"
+    );
+    console.log(
+      "\u25B6 production preview details: db preview compare-only profile (plan + hazard extraction)"
     );
     console.log(`\u25B6 production preview timeout: ${formatDurationMs(timeoutMs)}`);
     const heartbeat = startHeartbeat("production preview");
@@ -4598,7 +4468,7 @@ var productionPreviewActor = fromPromise(
     try {
       const child = execa(
         "pnpm",
-        ["exec", "runa", "db", "apply", "production", "--check", "--compare-only"],
+        ["exec", "runa", "db", "preview", "production", "--profile", "compare-only"],
         {
           cwd: repoRoot,
           env: {
@@ -4785,7 +4655,6 @@ function findBaseRef(repoRoot) {
     stdio: ["pipe", "pipe", "pipe"]
   });
   if (checkOriginMain.status === 0) {
-    console.log("[DEBUG] getSchemaGitDiff: Using origin/main as base");
     return "origin/main";
   }
   const baseRef = process.env.GITHUB_BASE_REF;
@@ -4796,9 +4665,6 @@ function findBaseRef(repoRoot) {
       stdio: ["pipe", "pipe", "pipe"]
     });
     if (checkBaseRef.status === 0) {
-      console.log(
-        `[DEBUG] getSchemaGitDiff: Using origin/${baseRef} as base (from GITHUB_BASE_REF)`
-      );
       return `origin/${baseRef}`;
     }
   }
@@ -4808,112 +4674,64 @@ function findBaseRef(repoRoot) {
     stdio: ["pipe", "pipe", "pipe"]
   });
   if (mergeBaseResult.status === 0 && mergeBaseResult.stdout?.trim()) {
-    console.log("[DEBUG] getSchemaGitDiff: Using merge-base as base");
     return mergeBaseResult.stdout.trim();
   }
-  console.log("[DEBUG] getSchemaGitDiff: No valid base reference found");
   return null;
 }
+function extractSchemaGitDiffSnapshot(diffOutput) {
+  const filesChanged = [];
+  const seenFiles = /* @__PURE__ */ new Set();
+  for (const match of diffOutput.matchAll(/^diff --git a\/(.+?) b\/(.+)$/gm)) {
+    const filePath = match[2] ?? match[1];
+    if (!filePath || seenFiles.has(filePath)) {
+      continue;
+    }
+    seenFiles.add(filePath);
+    filesChanged.push(filePath);
+  }
+  if (filesChanged.length === 0) {
+    return null;
+  }
+  let linesAdded = 0;
+  let linesDeleted = 0;
+  for (const line of diffOutput.split("\n")) {
+    if (line.startsWith("+") && !line.startsWith("+++")) {
+      linesAdded += 1;
+      continue;
+    }
+    if (line.startsWith("-") && !line.startsWith("---")) {
+      linesDeleted += 1;
+    }
+  }
+  const maxLines = 100;
+  const diffLines = diffOutput.split("\n");
+  const diffSummary = diffLines.length > maxLines ? `${diffLines.slice(0, maxLines).join("\n")}
+... (${diffLines.length - maxLines} more lines)` : diffOutput;
+  return {
+    filesChanged,
+    linesAdded,
+    linesDeleted,
+    diffSummary
+  };
+}
 function getSchemaGitDiff(repoRoot) {
   try {
     const baseRef = findBaseRef(repoRoot);
     if (!baseRef) {
-      console.log("[DEBUG] getSchemaGitDiff: Cannot determine base reference, skipping diff");
-      return null;
-    }
-    const filesResult = spawnSync(
-      "git",
-      ["diff", "--name-only", `${baseRef}...HEAD`, "--", "supabase/schemas/"],
-      { cwd: repoRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
-    );
-    if (filesResult.status !== 0) {
-      console.log(
-        `[DEBUG] getSchemaGitDiff: git diff failed: ${filesResult.stderr || "unknown error"}`
-      );
       return null;
     }
-    const filesChanged = (filesResult.stdout || "").split("\n").filter((f) => f.trim().length > 0);
-    console.log(`[DEBUG] getSchemaGitDiff: Found ${filesChanged.length} changed schema file(s)`);
-    if (filesChanged.length === 0) {
-      return null;
-    }
-    const statResult = spawnSync(
-      "git",
-      ["diff", "--stat", `${baseRef}...HEAD`, "--", "supabase/schemas/"],
-      { cwd: repoRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
-    );
-    const statOutput = statResult.stdout || "";
-    const statMatch = statOutput.match(/(\d+) insertions?\(\+\)/);
-    const delMatch = statOutput.match(/(\d+) deletions?\(-\)/);
-    const linesAdded = statMatch ? Number.parseInt(statMatch[1], 10) : 0;
-    const linesDeleted = delMatch ? Number.parseInt(delMatch[1], 10) : 0;
     const diffResult = spawnSync(
       "git",
       ["diff", "--no-color", `${baseRef}...HEAD`, "--", "supabase/schemas/"],
       { cwd: repoRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     );
-    const fullDiff = diffResult.stdout || "";
-    const maxLines = 100;
-    const diffLines = fullDiff.split("\n");
-    const diffSummary = diffLines.length > maxLines ? `${diffLines.slice(0, maxLines).join("\n")}
-... (${diffLines.length - maxLines} more lines)` : fullDiff;
-    return {
-      filesChanged,
-      linesAdded,
-      linesDeleted,
-      diffSummary
-    };
-  } catch (error) {
-    console.log(
-      `[DEBUG] getSchemaGitDiff: Exception: ${error instanceof Error ? error.message : String(error)}`
-    );
-    return null;
-  }
-}
-function extractRolesFromSql(content) {
-  const roles = [];
-  const roleMatches = content.matchAll(/CREATE\s+ROLE\s+(\w+)\s+WITH/gi);
-  for (const match of roleMatches) {
-    if (match[1]) roles.push(match[1].toLowerCase());
-  }
-  const existsMatches = content.matchAll(/rolname\s*=\s*'(\w+)'/gi);
-  for (const match of existsMatches) {
-    if (match[1] && !roles.includes(match[1].toLowerCase())) {
-      roles.push(match[1].toLowerCase());
-    }
-  }
-  return roles;
-}
-function getIdempotentRoleNames2(repoRoot) {
-  const idempotentDir = path4.join(repoRoot, "supabase", "schemas", "idempotent");
-  const roles = [];
-  try {
-    const fs2 = __require("fs");
-    if (!fs2.existsSync(idempotentDir)) return [];
-    const files = fs2.readdirSync(idempotentDir).filter((f) => f.endsWith(".sql"));
-    for (const file of files) {
-      const filePath = path4.join(idempotentDir, file);
-      if (!isPathContained(idempotentDir, filePath)) {
-        continue;
-      }
-      const content = fs2.readFileSync(filePath, "utf-8");
-      roles.push(...extractRolesFromSql(content));
+    if (diffResult.status !== 0) {
+      return null;
     }
+    return extractSchemaGitDiffSnapshot(diffResult.stdout || "");
   } catch {
+    return null;
   }
-  return [...new Set(roles)];
-}
-function isIdempotentRoleHazard2(hazardType, hazardMessage, idempotentRoles, causingSql) {
-  if (hazardType !== "AUTHZ_UPDATE") return false;
-  if (idempotentRoles.length === 0) return false;
-  const sql = ("").trim().toLowerCase();
-  const isGrantRevoke = /^\s*(?:grant|revoke)\b/i.test(sql);
-  if (sql && !isGrantRevoke) return false;
-  const textToCheck = sql || hazardMessage.toLowerCase();
-  for (const role of idempotentRoles) {
-    if (textToCheck.includes(role)) return true;
-  }
-  return false;
 }
 function createEmptySchemaChangeStats() {
   return {
@@ -4934,13 +4752,18 @@ function resolveSqlInput(sqlInput, logPath) {
     return null;
   }
 }
-function parseHazards(sql, idempotentRoles) {
+function parseHazards(sql, schemasDir) {
   const hazards = [];
   const hazardMatches = sql.matchAll(/-- Hazard (\w+): (.+)/g);
   for (const match of hazardMatches) {
     const hazardType = match[1];
     const hazardMessage = match[2];
-    if (isIdempotentRoleHazard2(hazardType, hazardMessage, idempotentRoles)) {
+    const registryHazard = {
+      type: hazardType,
+      message: hazardMessage,
+      fullMatch: match[0]
+    };
+    if (isIdempotentRoleHazard(registryHazard, schemasDir)) {
       continue;
     }
     hazards.push(`${hazardType}: ${hazardMessage}`);
@@ -4960,8 +4783,8 @@ function parseSchemaChangeStats(sqlInput, logPath, repoRoot) {
   stats.creates.other = countMatches(sql, /CREATE (TRIGGER|TYPE|SEQUENCE|VIEW|SCHEMA)/gi);
   stats.alters = countMatches(sql, /ALTER (TABLE|COLUMN|INDEX|POLICY|FUNCTION)/gi);
   stats.drops = countMatches(sql, /DROP (TABLE|COLUMN|INDEX|POLICY|FUNCTION|TRIGGER)/gi);
-  const idempotentRoles = repoRoot ? getIdempotentRoleNames2(repoRoot) : [];
-  stats.hazards = parseHazards(sql, idempotentRoles);
+  const schemasDir = repoRoot ? path4.join(repoRoot, "supabase", "schemas", "declarative") : void 0;
+  stats.hazards = parseHazards(sql, schemasDir);
   return stats;
 }
 function isCheckSummaryOutput(output) {
@@ -5235,9 +5058,9 @@ function detectSupabaseContainers() {
 async function checkSupabasePortConflicts(repoRoot) {
   let dbPort = 54322;
   try {
-    const { readFileSync: readFileSync5 } = await import('fs');
+    const { readFileSync: readFileSync4 } = await import('fs');
     const configPath = path4.join(repoRoot, "supabase", "config.toml");
-    const content = readFileSync5(configPath, "utf-8");
+    const content = readFileSync4(configPath, "utf-8");
     const match = /\[db\][^[]*?port\s*=\s*(\d+)/s.exec(content);
     if (match?.[1]) dbPort = Number.parseInt(match[1], 10);
   } catch {
@@ -5481,7 +5304,7 @@ function shouldSkipSchemaPostCheck(context) {
   return context.mode === "ci-pr-local" && context.executionEnv === "github-actions";
 }
 function shouldReuseCiReferenceStats(context) {
-  return context.mode !== "ci-local" && context.schemaApplied && context.schemaDrift !== null && context.schemaDrift?.hasDrift === false;
+  return context.mode !== "ci-local" && context.schemaApplied && context.schemaDrift !== null && context.schemaDrift?.checkExecuted === true && context.schemaDrift?.hasDrift === false;
 }
 function mergeLayerResults(coreResults, e2eResults) {
   return { ...coreResults, ...e2eResults };
@@ -5617,6 +5440,11 @@ init_esm_shims();
 
 // src/commands/ci/commands/ci-pr-capabilities.ts
 init_esm_shims();
+
+// src/commands/ci/commands/layer4-discovery.ts
+init_esm_shims();
+
+// src/commands/ci/commands/ci-pr-capabilities.ts
 async function pathExists(p) {
   return promises.access(p).then(() => true).catch(() => false);
 }
@@ -5654,116 +5482,96 @@ async function queryScalar(params) {
 async function detectDbCapabilities(params) {
   const caps = /* @__PURE__ */ new Set();
   const diagnostics = {};
-  const isPostgresRaw = await queryScalar({
+  const batchedSql = `
+SELECT json_build_object(
+  'isPostgres', (SELECT version() LIKE 'PostgreSQL%'),
+  'tableCount', (
+    SELECT COUNT(*)::int
+    FROM information_schema.tables
+    WHERE table_type = 'BASE TABLE'
+      AND table_schema NOT LIKE 'pg_%'
+      AND table_schema NOT IN ('information_schema')
+  ),
+  'rlsCount', (
+    SELECT COUNT(*)::int
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.relkind IN ('r', 'p')
+      AND n.nspname NOT LIKE 'pg_%'
+      AND n.nspname NOT IN ('information_schema')
+      AND c.relrowsecurity
+  ),
+  'canSelectAny', (
+    SELECT COALESCE(bool_or(has_table_privilege(current_user, tbl, 'select')), false)
+    FROM (
+      SELECT quote_ident(table_schema) || '.' || quote_ident(table_name) AS tbl
+      FROM information_schema.tables
+      WHERE table_type = 'BASE TABLE'
+        AND table_schema NOT LIKE 'pg_%'
+        AND table_schema NOT IN ('information_schema')
+      LIMIT 50  -- cap sampling to prevent slow scans on large databases
+    ) candidates
+  ),
+  'authenticatedExists', (
+    SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+  ),
+  'isMember', (
+    SELECT CASE
+      WHEN EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+      THEN pg_has_role(current_user, 'authenticated', 'member')
+      ELSE false
+    END
+  )
+)::text;
+  `.trim();
+  const raw = await queryScalar({
     repoRoot: params.repoRoot,
     tmpDir: params.tmpDir,
     databaseUrl: params.databaseUrlApp,
-    sql: "SELECT version() LIKE 'PostgreSQL%';",
-    logName: "cap-is-postgres"
+    sql: batchedSql,
+    logName: "cap-db-batch"
   });
-  const isPostgres = parseBoolish(isPostgresRaw);
-  if (isPostgres) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    diagnostics["db.postgres"] = `Failed to parse batched query result (raw=${raw.substring(0, 200)})`;
+    return { capabilities: caps, diagnostics };
+  }
+  if (parsed.isPostgres) {
     caps.add("db.postgres");
     diagnostics["db.postgres"] = "PostgreSQL detected via SELECT version()";
   } else {
-    diagnostics["db.postgres"] = `Not PostgreSQL (raw=${isPostgresRaw})`;
+    diagnostics["db.postgres"] = `Not PostgreSQL`;
     return { capabilities: caps, diagnostics };
   }
-  const tablesRaw = await queryScalar({
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    databaseUrl: params.databaseUrlApp,
-    sql: `
-SELECT COUNT(*)::int
-FROM information_schema.tables
-WHERE table_type='BASE TABLE'
-AND table_schema NOT LIKE 'pg_%'
-AND table_schema NOT IN ('information_schema');
-    `.trim(),
-    logName: "cap-table-count"
-  });
-  const tableCount = Number.parseInt(tablesRaw, 10);
-  if (Number.isFinite(tableCount) && tableCount > 0) {
+  if (Number.isFinite(parsed.tableCount) && parsed.tableCount > 0) {
     caps.add("db.schemaApplied");
-    diagnostics["db.schemaApplied"] = `Non-system base tables detected: ${tableCount}`;
+    diagnostics["db.schemaApplied"] = `Non-system base tables detected: ${parsed.tableCount}`;
   } else {
-    diagnostics["db.schemaApplied"] = `No non-system base tables detected (raw=${tablesRaw})`;
+    diagnostics["db.schemaApplied"] = `No non-system base tables detected (count=${parsed.tableCount})`;
   }
-  const rlsCountRaw = await queryScalar({
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    databaseUrl: params.databaseUrlApp,
-    sql: `
-SELECT COUNT(*)::int
-FROM pg_class c
-JOIN pg_namespace n ON n.oid=c.relnamespace
-WHERE c.relkind IN ('r','p')
-AND n.nspname NOT LIKE 'pg_%'
-AND n.nspname NOT IN ('information_schema')
-AND c.relrowsecurity;
-    `.trim(),
-    logName: "cap-rls-count"
-  });
-  const rlsCount = Number.parseInt(rlsCountRaw, 10);
-  if (Number.isFinite(rlsCount) && rlsCount > 0) {
+  if (Number.isFinite(parsed.rlsCount) && parsed.rlsCount > 0) {
     caps.add("db.rlsEnabled");
-    diagnostics["db.rlsEnabled"] = `RLS-enabled tables detected: ${rlsCount}`;
+    diagnostics["db.rlsEnabled"] = `RLS-enabled tables detected: ${parsed.rlsCount}`;
   } else {
-    diagnostics["db.rlsEnabled"] = `No RLS-enabled tables detected (raw=${rlsCountRaw})`;
+    diagnostics["db.rlsEnabled"] = `No RLS-enabled tables detected (count=${parsed.rlsCount})`;
   }
-  const canSelectAnyRaw = await queryScalar({
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    databaseUrl: params.databaseUrlApp,
-    sql: `
-WITH candidates AS (
-  SELECT quote_ident(table_schema)||'.'||quote_ident(table_name) AS tbl
-  FROM information_schema.tables
-  WHERE table_type='BASE TABLE'
-    AND table_schema NOT LIKE 'pg_%'
-    AND table_schema NOT IN ('information_schema')
-  LIMIT 50
-),
-checks AS (
-  SELECT bool_or(has_table_privilege(current_user, tbl, 'select')) AS ok
-  FROM candidates
-)
-SELECT COALESCE(ok,false) FROM checks;
-    `.trim(),
-    logName: "cap-select-any"
-  });
-  const canSelectAny = parseBoolish(canSelectAnyRaw);
-  if (canSelectAny) {
+  if (parsed.canSelectAny) {
     caps.add("db.appCanSelectSomeTable");
     diagnostics["db.appCanSelectSomeTable"] = "has_table_privilege(select) true for at least one table";
   } else {
-    diagnostics["db.appCanSelectSomeTable"] = `App role cannot SELECT any sampled table (raw=${canSelectAnyRaw})`;
+    diagnostics["db.appCanSelectSomeTable"] = "App role cannot SELECT any sampled table";
   }
-  const authenticatedExistsRaw = await queryScalar({
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    databaseUrl: params.databaseUrlApp,
-    sql: "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname='authenticated');",
-    logName: "cap-authenticated-role-exists"
-  });
-  const authenticatedExists = parseBoolish(authenticatedExistsRaw);
-  if (!authenticatedExists) {
+  if (!parsed.authenticatedExists) {
     diagnostics["db.appIsAuthenticatedMember"] = "n/a (authenticated role does not exist)";
     return { capabilities: caps, diagnostics };
   }
-  const isMemberRaw = await queryScalar({
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    databaseUrl: params.databaseUrlApp,
-    sql: "SELECT pg_has_role(current_user, 'authenticated', 'member');",
-    logName: "cap-app-is-authenticated-member"
-  });
-  const isMember = parseBoolish(isMemberRaw);
-  if (isMember) {
+  if (parsed.isMember) {
     caps.add("db.appIsAuthenticatedMember");
     diagnostics["db.appIsAuthenticatedMember"] = "pg_has_role(member, authenticated) is true";
   } else {
-    diagnostics["db.appIsAuthenticatedMember"] = `pg_has_role(member, authenticated)=false (raw=${isMemberRaw})`;
+    diagnostics["db.appIsAuthenticatedMember"] = "pg_has_role(member, authenticated)=false";
   }
   return { capabilities: caps, diagnostics };
 }
@@ -5775,12 +5583,22 @@ function isPlaywrightIgnored(filePath) {
 async function detectGeneratedE2eCapabilities(params) {
   const caps = /* @__PURE__ */ new Set();
   const diagnostics = {};
-  const layer4Dir = path4.join(params.repoRoot, ".runa", "tests", "layer4");
-  const tmpDir = path4.join(params.repoRoot, ".runa", "tmp");
+  let layer4Dir;
+  let tmpDir;
+  try {
+    const discovery = resolveLayer4DiscoverySync(params.repoRoot);
+    layer4Dir = discovery.currentOutputDir;
+    tmpDir = discovery.tmpDir;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    diagnostics["e2e.generatedLayer4Present"] = `Layer 4 discovery failed: ${message}`;
+    diagnostics["e2e.generatedLayer4HasUnknown"] = "n/a (Layer 4 discovery failed)";
+    return { capabilities: caps, diagnostics };
+  }
   const hasLayer4Dir = await pathExists(layer4Dir);
   const hasTmpDir = await pathExists(tmpDir);
   if (!hasLayer4Dir && !hasTmpDir) {
-    diagnostics["e2e.generatedLayer4Present"] = "Missing .runa/tests/layer4 and .runa/tmp";
+    diagnostics["e2e.generatedLayer4Present"] = `Missing current Layer 4 artifact dirs (${layer4Dir}, ${tmpDir})`;
     diagnostics["e2e.generatedLayer4HasUnknown"] = "n/a (layer4 tests not present)";
     return { capabilities: caps, diagnostics };
   }
@@ -5874,23 +5692,25 @@ async function detectUiContractReady(params) {
 async function detectCiCapabilities(params) {
   const caps = /* @__PURE__ */ new Set();
   const diagnostics = {};
-  const db = await detectDbCapabilities({
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    databaseUrlApp: params.databaseUrlApp
-  });
-  for (const c of db.capabilities) caps.add(c);
-  for (const [k, v] of Object.entries(db.diagnostics)) diagnostics[k] = String(v);
-  const e2e = await detectGeneratedE2eCapabilities({ repoRoot: params.repoRoot });
-  for (const c of e2e.capabilities) caps.add(c);
-  for (const [k, v] of Object.entries(e2e.diagnostics)) diagnostics[k] = String(v);
+  const mergeDiagnostics = (result) => {
+    for (const c of result.capabilities) caps.add(c);
+    for (const [k, v] of Object.entries(result.diagnostics))
+      diagnostics[k] = String(v);
+  };
+  const [db, e2e, ui] = await Promise.all([
+    detectDbCapabilities({
+      repoRoot: params.repoRoot,
+      tmpDir: params.tmpDir,
+      databaseUrlApp: params.databaseUrlApp
+    }),
+    detectGeneratedE2eCapabilities({ repoRoot: params.repoRoot }),
+    detectUiContractReady({ baseUrl: params.baseUrl })
+  ]);
+  mergeDiagnostics(db);
+  mergeDiagnostics(e2e);
+  mergeDiagnostics(ui);
   const preview = await detectPreviewReachable({ baseUrl: params.baseUrl });
-  for (const c of preview.capabilities) caps.add(c);
-  for (const [k, v] of Object.entries(preview.diagnostics))
-    diagnostics[k] = String(v);
-  const ui = await detectUiContractReady({ baseUrl: params.baseUrl });
-  for (const c of ui.capabilities) caps.add(c);
-  for (const [k, v] of Object.entries(ui.diagnostics)) diagnostics[k] = String(v);
+  mergeDiagnostics(preview);
   return { capabilities: Array.from(caps), diagnostics };
 }
 function resolveRequiredCapabilities(params) {
@@ -5937,6 +5757,58 @@ function assertCapabilities(params) {
   );
 }
 
+// src/commands/ci/machine/actors/test/capabilities.ts
+var capabilitiesActor = fromPromise(
+  async ({ input }) => {
+    const { repoRoot, tmpDir, databaseUrlApp, baseUrl } = input;
+    try {
+      const detected = await detectCiCapabilities({
+        repoRoot,
+        tmpDir,
+        databaseUrlApp,
+        baseUrl
+      });
+      return { detected };
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      console.warn(`[Capabilities] Detection failed: ${errorMsg}`);
+      return {
+        detected: { capabilities: [], diagnostics: {} },
+        error: errorMsg
+      };
+    }
+  }
+);
+fromPromise(
+  async ({ input }) => {
+    const { config, repoKind, layer, detected } = input;
+    try {
+      const required = resolveRequiredCapabilities({ config, repoKind, layer });
+      const missing = required.filter((r) => !detected.capabilities.includes(r));
+      if (missing.length > 0) {
+        assertCapabilities({
+          required,
+          detected,
+          label: `Layer ${layer} capability gate`
+        });
+      }
+      return { passed: true, required, missing: [] };
+    } catch (error) {
+      const required = resolveRequiredCapabilities({ config, repoKind, layer });
+      const missing = required.filter((r) => !detected.capabilities.includes(r));
+      return {
+        passed: false,
+        required,
+        missing,
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+);
+
+// src/commands/ci/machine/actors/test/layer-content.ts
+init_esm_shims();
+
 // src/commands/ci/commands/ci-layer-content.ts
 init_esm_shims();
 var MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024;
@@ -6420,71 +6292,36 @@ async function detectLayerContent(repoRoot, selectedLayers, manifestPath) {
   return { layers, skippedLayers, runnableLayers };
 }
 
-// src/commands/ci/machine/actors/test/capabilities.ts
-var capabilitiesActor = fromPromise(
+// src/commands/ci/machine/actors/test/layer-content.ts
+var layerContentActor = fromPromise(
   async ({ input }) => {
-    const { repoRoot, tmpDir, databaseUrlApp, baseUrl, selectedLayers } = input;
+    const { repoRoot, selectedLayers } = input;
     try {
-      const detected = await detectCiCapabilities({
-        repoRoot,
-        tmpDir,
-        databaseUrlApp,
-        baseUrl
-      });
       const layerContent = await detectLayerContent(repoRoot, selectedLayers);
-      return { detected, layerContent };
+      return { layerContent };
     } catch (error) {
-      const errorMsg = error instanceof Error ? error.message : String(error);
-      console.warn(`[Capabilities] Layer content detection failed: ${errorMsg}`);
-      const fallbackLayers = {};
-      for (const layer of selectedLayers) {
-        fallbackLayers[layer] = {
-          layer,
-          hasContent: true,
-          // Conservative: assume content exists
-          contentType: "machines",
-          // Placeholder
-          count: 0,
-          source: "filesystem",
-          skipReason: `Detection failed: ${errorMsg}`
-          // Track why we're using fallback
-        };
-      }
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      console.warn(`[Layer Content] Detection failed: ${errorMessage}`);
       const fallbackLayerContent = {
-        layers: fallbackLayers,
+        layers: Object.fromEntries(
+          selectedLayers.map((layer) => [
+            layer,
+            {
+              layer,
+              hasContent: true,
+              contentType: "machines",
+              count: 0,
+              source: "filesystem",
+              skipReason: `Detection failed: ${errorMessage}`
+            }
+          ])
+        ),
         skippedLayers: [],
         runnableLayers: selectedLayers
       };
       return {
-        detected: { capabilities: [], diagnostics: {} },
         layerContent: fallbackLayerContent,
-        error: errorMsg
-      };
-    }
-  }
-);
-fromPromise(
-  async ({ input }) => {
-    const { config, repoKind, layer, detected } = input;
-    try {
-      const required = resolveRequiredCapabilities({ config, repoKind, layer });
-      const missing = required.filter((r) => !detected.capabilities.includes(r));
-      if (missing.length > 0) {
-        assertCapabilities({
-          required,
-          detected,
-          label: `Layer ${layer} capability gate`
-        });
-      }
-      return { passed: true, required, missing: [] };
-    } catch (error) {
-      const required = resolveRequiredCapabilities({ config, repoKind, layer });
-      const missing = required.filter((r) => !detected.capabilities.includes(r));
-      return {
-        passed: false,
-        required,
-        missing,
-        error: error instanceof Error ? error.message : String(error)
+        error: errorMessage
       };
     }
   }
@@ -6711,9 +6548,6 @@ var runLayersActor = fromPromise(
       progressIntervalSeconds = 30
     } = input;
     try {
-      console.log(
-        `[DEBUG] runLayersActor: Starting with layers=${JSON.stringify(layers)}, failFast=${failFast}`
-      );
       const results = await runLayersInParallel({
         repoRoot,
         tmpDir,
@@ -6727,15 +6561,9 @@ var runLayersActor = fromPromise(
       });
       const failedLayers = results.filter((r) => !r.success).map((r) => r.layer);
       const allPassed = failedLayers.length === 0;
-      console.log(
-        `[DEBUG] runLayersActor: Complete. results=${results.length}, failedLayers=${JSON.stringify(failedLayers)}, allPassed=${allPassed}`
-      );
       return { results, allPassed, failedLayers };
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : String(error);
-      console.log(
-        `[DEBUG] runLayersActor: Caught error: ${errorMessage}. Returning failedLayers=${JSON.stringify(layers)}`
-      );
       return {
         results: [],
         allPassed: false,
@@ -6761,9 +6589,6 @@ function getEffectiveMode(context) {
 function isCiLocalMode(context) {
   return getEffectiveMode(context) === "ci-local";
 }
-function isCiPrLocalMode(context) {
-  return getEffectiveMode(context) === "ci-pr-local";
-}
 function isCiPrMode(context) {
   return getEffectiveMode(context) === "ci-pr-local";
 }
@@ -6785,7 +6610,9 @@ function shouldSkipStaticChecks(context) {
   return shouldSkipStep(context, "staticChecks");
 }
 function shouldSkipBuild(context) {
-  return shouldSkipStep(context, "build");
+  if (shouldSkipStep(context, "build")) return true;
+  const requiresBuild = context.selectedLayers.some((layer) => layer === 3 || layer === 4);
+  return !requiresBuild;
 }
 function shouldSkipAppStart(context) {
   return shouldSkipStep(context, "appStart");
@@ -6812,8 +6639,19 @@ function shouldPostGitHubComment(context) {
   if (context.input.skipGithubComment === true) return false;
   return true;
 }
+function isObservabilityPhase(context) {
+  return isCiPrMode(context) && context.phase === "observability";
+}
 function isTestPhase(context) {
-  return isCiPrMode(context) && context.input.phase === "test";
+  return isCiPrMode(context) && context.phase === "test";
+}
+function shouldRunPrExecutionPhase(context) {
+  if (!isCiPrMode(context)) return true;
+  return !isObservabilityPhase(context);
+}
+function shouldRunPrObservabilityPhase(context) {
+  if (!isCiPrMode(context)) return true;
+  return !isTestPhase(context);
 }
 function hasError(context) {
   return context.error !== null;
@@ -6868,7 +6706,7 @@ init_esm_shims();
 
 // src/commands/ci/machine/formatters/sections/format-helpers.ts
 init_esm_shims();
-function formatDuration4(ms) {
+function formatDuration3(ms) {
   if (ms < 1e3) return `${ms}ms`;
   const seconds = Math.floor(ms / 1e3);
   if (seconds < 60) return `${seconds}s`;
@@ -7560,9 +7398,10 @@ function truncateSql(sql, maxLength) {
 }
 function generatePreviewDetails(prodPreview) {
   const truncatedSql = truncateSql(prodPreview.planSql || "", 2e3);
+  const profileLabel = prodPreview.profile ?? "compare-only";
   return [
     "<details>",
-    "<summary>\u{1F4CB} \u672C\u756A\u30B9\u30AD\u30FC\u30DE\u30D7\u30EC\u30D3\u30E5\u30FC (dry-run)</summary>",
+    `<summary>\u{1F4CB} \u672C\u756A\u30B9\u30AD\u30FC\u30DE\u30D7\u30EC\u30D3\u30E5\u30FC (${profileLabel})</summary>`,
     "",
     "**\u672C\u756A\u306B\u9069\u7528\u4E88\u5B9A\u306ESQL:**",
     "",
@@ -7641,7 +7480,7 @@ function generatePreviewChangesDetectedSection(prodPreview, previewOnlyChanges)
   ];
   if (previewOnlyChanges) {
     lines.push(
-      "> \u88DC\u8DB3: `Prod semantic diff` / count diff / index diff \u3067\u306F\u5DEE\u5206\u304C\u306A\u304F\u3001`production --check` \u306E\u307F\u304C\u5909\u66F4\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\u3002",
+      "> \u88DC\u8DB3: `Prod semantic diff` / count diff / index diff \u3067\u306F\u5DEE\u5206\u304C\u306A\u304F\u3001`db preview --profile compare-only` \u306E\u307F\u304C\u5909\u66F4\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\u3002",
       "> \u3053\u308C\u306F ownership / session config / planner-only rewrite \u306A\u3069\u3001canonical diff \u3067\u306F\u8FFD\u308F\u306A\u3044\u5DEE\u5206\u3067\u3042\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002",
       ""
     );
@@ -7684,7 +7523,7 @@ function generateComparisonMismatchSection(schemaStats, expectedDrift) {
   const lines = [
     "> \u{1F536} **\u672C\u756ADB\u3068\u306E\u5DEE\u5206\u691C\u51FA - \u672C\u756A\u30C7\u30D7\u30ED\u30A4\u304C\u5FC5\u8981\u3067\u3059**",
     ">",
-    "> `runa db apply production --check` \u306F\u5909\u66F4\u306A\u3057\u5224\u5B9A\u3067\u3057\u305F\u304C\u3001Reference \u2194 Prod \u306E\u6BD4\u8F03\u3067\u5DEE\u5206\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\u3002",
+    "> `runa db preview production --profile compare-only` \u306F\u5909\u66F4\u306A\u3057\u5224\u5B9A\u3067\u3057\u305F\u304C\u3001Reference \u2194 Prod \u306E\u6BD4\u8F03\u3067\u5DEE\u5206\u3092\u691C\u51FA\u3057\u307E\u3057\u305F\u3002",
     "> \u30B9\u30AD\u30FC\u30DE\u30DE\u30C8\u30EA\u30C3\u30AF\u30B9\u306E `Prod semantic diff` \u3068\u8A73\u7D30\u30ED\u30B0\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
     ""
   ];
@@ -7713,6 +7552,10 @@ function generateKnownDriftOnlySection(schemaStats, expectedDrift) {
 }
 function generateProductionPreviewSection(phase, prodPreview, schemaDrift, schemaStats, expectedDrift) {
   const signals = getProductionSchemaSignals(prodPreview, schemaStats, expectedDrift);
+  const deferredSection = getDeferredProductionPreviewSection(phase, prodPreview);
+  if (deferredSection.length > 0) {
+    return deferredSection;
+  }
   if (!prodPreview?.executed) {
     if (schemaDrift?.gitDiff?.filesChanged?.length) {
       return [
@@ -7736,19 +7579,34 @@ function generateProductionPreviewSection(phase, prodPreview, schemaDrift, schem
   }
   return ["**\u672C\u756A\u30D7\u30EC\u30D3\u30E5\u30FC**: \u2705 \u672C\u756A\u306B\u9069\u7528\u3059\u308B\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u306F\u3042\u308A\u307E\u305B\u3093", ""];
 }
-function shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges2) {
-  if (hasSchemaChanges2) return true;
+function getDeferredProductionPreviewSection(phase, prodPreview) {
+  if (prodPreview?.executed) return [];
+  switch (phase) {
+    case "test":
+      return [
+        "**\u672C\u756A\u30D7\u30EC\u30D3\u30E5\u30FC**: \u23ED\uFE0F phase=test \u306E\u305F\u3081\u30B9\u30AD\u30C3\u30D7",
+        "",
+        "> workflow-prepared DB \u3092\u518D\u5229\u7528\u3059\u308B\u8EFD\u91CF\u30D5\u30A7\u30FC\u30BA\u306E\u305F\u3081\u3001\u672C\u756A\u6BD4\u8F03\u306F\u5B9F\u884C\u3057\u3066\u3044\u307E\u305B\u3093\u3002",
+        ""
+      ];
+    default:
+      return [];
+  }
+}
+function shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges) {
+  if (hasSchemaChanges) return true;
   if (productionPreview?.error) return true;
   if (!productionPreview?.executed && schemaDrift?.gitDiff?.filesChanged?.length) return true;
   return false;
 }
 function generateDeploySection(exitCode, layerResults, phase, gitBranchName, productionPreview, schemaDrift, schemaStats, expectedDrift, env) {
   if (!checkIfDeployable(exitCode, layerResults)) return [];
+  if (phase === "test") return [];
   const deployWorkflowUrl = env.repository ? `${env.serverUrl}/${env.repository}/actions/workflows/deploy-db.yml` : null;
   const signals = getProductionSchemaSignals(productionPreview, schemaStats, expectedDrift);
-  const hasSchemaChanges2 = signals.requiresDeploy;
-  const headerEmoji = hasSchemaChanges2 ? "\u{1F6A8}" : "\u{1F680}";
-  const headerText = hasSchemaChanges2 ? "\u672C\u756A\u30C7\u30D7\u30ED\u30A4 (\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3042\u308A!)" : "\u672C\u756A\u30C7\u30D7\u30ED\u30A4";
+  const hasSchemaChanges = signals.requiresDeploy;
+  const headerEmoji = hasSchemaChanges ? "\u{1F6A8}" : "\u{1F680}";
+  const headerText = hasSchemaChanges ? "\u672C\u756A\u30C7\u30D7\u30ED\u30A4 (\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3042\u308A!)" : "\u672C\u756A\u30C7\u30D7\u30ED\u30A4";
   const lines = ["---", "", `### ${headerEmoji} ${headerText}`, ""];
   if (exitCode !== 0)
     lines.push("> **\u6CE8**: Layer 4 (E2E) \u306F\u5931\u6557\u3057\u307E\u3057\u305F\u304C\u3001\u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u306F\u30C7\u30D7\u30ED\u30A4\u53EF\u80FD\u3067\u3059\u3002", "");
@@ -7761,9 +7619,9 @@ function generateDeploySection(exitCode, layerResults, phase, gitBranchName, pro
       expectedDrift
     )
   );
-  const showButton = shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges2);
+  const showButton = shouldShowDeployButton(productionPreview, schemaDrift, hasSchemaChanges);
   if (deployWorkflowUrl && showButton) {
-    const buttonText = hasSchemaChanges2 ? "\u26A1 \u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3092\u672C\u756A\u306B\u30C7\u30D7\u30ED\u30A4" : "\u25B6\uFE0F \u672C\u756A\u306B\u30C7\u30D7\u30ED\u30A4";
+    const buttonText = hasSchemaChanges ? "\u26A1 \u30B9\u30AD\u30FC\u30DE\u5909\u66F4\u3092\u672C\u756A\u306B\u30C7\u30D7\u30ED\u30A4" : "\u25B6\uFE0F \u672C\u756A\u306B\u30C7\u30D7\u30ED\u30A4";
     lines.push(
       `**\u30C7\u30D7\u30ED\u30A4\u30D6\u30E9\u30F3\u30C1**: \`${gitBranchName}\``,
       "",
@@ -7778,23 +7636,32 @@ function generateDeploySection(exitCode, layerResults, phase, gitBranchName, pro
 function generateObservabilitySectionBody(input) {
   const env = getGitHubEnv();
   const gitBranchName = input.prContext?.headBranch ?? input.branchName ?? "unknown";
+  const deploySection = generateDeploySection(
+    input.exitCode,
+    input.layerResults,
+    input.phase,
+    gitBranchName,
+    input.productionPreview,
+    input.schemaDrift,
+    input.schemaStats ?? null,
+    input.expectedDrift ?? [],
+    env
+  );
+  const standalonePreviewLines = deploySection.length === 0 ? generateProductionPreviewSection(
+    input.phase,
+    input.productionPreview,
+    input.schemaDrift,
+    input.schemaStats ?? null,
+    input.expectedDrift ?? []
+  ) : [];
   const lines = [
     ...formatSchemaMatrix(
       input.schemaStats,
       input.schemaDrift?.gitDiff ?? null,
       input.expectedDrift ?? []
     ),
-    ...generateDeploySection(
-      input.exitCode,
-      input.layerResults,
-      input.phase,
-      gitBranchName,
-      input.productionPreview,
-      input.schemaDrift,
-      input.schemaStats ?? null,
-      input.expectedDrift ?? [],
-      env
-    )
+    ...standalonePreviewLines,
+    ...deploySection
   ];
   return lines.join("\n").trim();
 }
@@ -7863,11 +7730,11 @@ function generateCommentBody(input) {
 
 // src/commands/ci/machine/formatters/sections/progress-comment.ts
 init_esm_shims();
-function calculateTotalElapsed(stepTimings2) {
-  if (!stepTimings2) return 0;
-  return Object.values(stepTimings2).reduce((sum, t) => sum + (t ?? 0), 0);
+function calculateTotalElapsed(stepTimings) {
+  if (!stepTimings) return 0;
+  return Object.values(stepTimings).reduce((sum, t) => sum + (t ?? 0), 0);
 }
-function formatProgressBar(currentStep, completedSteps, failedStep, skippedSteps) {
+function formatProgressBar(_currentStep, completedSteps, failedStep, skippedSteps) {
   const total = CI_STEPS.length;
   const completedBase = completedSteps.length + skippedSteps.length;
   const completed = failedStep ? completedBase : completedBase + 1;
@@ -8004,7 +7871,7 @@ function generateProgressHeader(currentStep, failedStep, completedSteps, skipped
     );
   }
   if (totalElapsed > 0) {
-    lines.push(`<sub>\u23F1\uFE0F \u7D4C\u904E\u6642\u9593: ${formatDuration4(totalElapsed)}</sub>`);
+    lines.push(`<sub>\u23F1\uFE0F \u7D4C\u904E\u6642\u9593: ${formatDuration3(totalElapsed)}</sub>`);
   }
   lines.push("");
   return lines;
@@ -8018,13 +7885,13 @@ function generateInfoLine(branchName, supabaseUrl, runUrl) {
   if (runUrl) items.push(`[\u{1F517} \u30EF\u30FC\u30AF\u30D5\u30ED\u30FC](${runUrl})`);
   return [items.join(" \xB7 "), ""];
 }
-function generateProgressSteps(currentStep, completedSteps, failedStep, skippedSteps, stepTimings2, schemaDrift, layerResults, productionPreview) {
+function generateProgressSteps(currentStep, completedSteps, failedStep, skippedSteps, stepTimings, schemaDrift, layerResults, productionPreview) {
   const lines = ["### \u9032\u6357", ""];
   for (const { step, label, detail } of CI_STEPS) {
     const status = getStepStatus(step, currentStep, completedSteps, failedStep, skippedSteps);
     const icon = getStepIcon(status);
-    const timing = stepTimings2?.[step];
-    const timingStr = timing !== void 0 ? ` \`${formatDuration4(timing)}\`` : "";
+    const timing = stepTimings?.[step];
+    const timingStr = timing !== void 0 ? ` \`${formatDuration3(timing)}\`` : "";
     const stepDetail = getStepDetail(step, status, schemaDrift, layerResults);
     const runningDetail = getRunningStepDetail(step, detail, productionPreview);
     if (status === "running" && runningDetail) {
@@ -8058,7 +7925,7 @@ function getFixSuggestions(failedStep) {
     ],
     observability: [
       "production preview / schema stats \u306E\u30ED\u30B0\u3092\u78BA\u8A8D",
-      "\u672C\u756A DB \u63A5\u7D9A\u60C5\u5831\u3068 compare-only dry-run \u306E\u51FA\u529B\u3092\u78BA\u8A8D",
+      "\u672C\u756A DB \u63A5\u7D9A\u60C5\u5831\u3068 db preview compare-only \u306E\u51FA\u529B\u3092\u78BA\u8A8D",
       "schema stats \u304C\u5FC5\u8981\u306A\u30B1\u30FC\u30B9\u304B expected drift \u8A2D\u5B9A\u3092\u78BA\u8A8D"
     ],
     staticChecks: [
@@ -8125,6 +7992,11 @@ function generateTestResultsSection(layerResults) {
 }
 function generateProductionSchemaSection(productionPreview, phase, deployStatus, env) {
   const lines = ["### \u{1F4CB} \u672C\u756A\u30B9\u30AD\u30FC\u30DE\u72B6\u6CC1", ""];
+  const deferredMessage = getDeferredProductionPreviewMessage(phase, productionPreview);
+  if (!deployStatus?.deployed && deferredMessage) {
+    lines.push(deferredMessage, "");
+    return lines;
+  }
   const state = resolveProductionSchemaState(productionPreview, deployStatus);
   switch (state) {
     case "deployed":
@@ -8149,6 +8021,15 @@ function generateProductionSchemaSection(productionPreview, phase, deployStatus,
   }
   return lines;
 }
+function getDeferredProductionPreviewMessage(phase, productionPreview) {
+  if (productionPreview?.executed) return null;
+  switch (phase) {
+    case "test":
+      return "\u23ED\uFE0F _phase=test \u306E\u305F\u3081\u3001\u672C\u756A\u6BD4\u8F03\u306F\u30B9\u30AD\u30C3\u30D7\u3055\u308C\u3066\u3044\u307E\u3059_";
+    default:
+      return null;
+  }
+}
 function resolveProductionSchemaState(productionPreview, deployStatus) {
   if (deployStatus?.deployed) return "deployed";
   if (!productionPreview) return "checking";
@@ -8191,13 +8072,15 @@ function appendChangesPendingSection(lines, productionPreview, env) {
   if (!productionPreview) return;
   const hazardCount = productionPreview.hazards.length;
   const hazardText = hazardCount > 0 ? ` (\u26A0\uFE0F ${hazardCount}\u4EF6\u306E\u30CF\u30B6\u30FC\u30C9)` : "";
-  lines.push(`\u26A0\uFE0F **\u5909\u66F4\u5F85\u3061**${hazardText}`, "");
+  const profileText = productionPreview.profile ? ` [${productionPreview.profile}]` : "";
+  lines.push(`\u26A0\uFE0F **\u5909\u66F4\u5F85\u3061**${profileText}${hazardText}`, "");
   if (productionPreview.planSql) {
     appendPlanSqlPreview(lines, productionPreview.planSql);
   }
   appendDeployLink(lines, env);
 }
-function generateDbDeploySection(layerResults, gitBranchName, productionPreview, env) {
+function generateDbDeploySection(phase, layerResults, gitBranchName, productionPreview, env) {
+  if (phase === "test") return [];
   if (!checkBlockingLayersPassed(layerResults)) return [];
   if (productionPreview?.hasChanges) return [];
   const deployWorkflowUrl = env.repository ? `${env.serverUrl}/${env.repository}/actions/workflows/deploy-db.yml` : null;
@@ -8230,13 +8113,13 @@ function generateProgressCommentBody(input) {
     productionPreview,
     deployStatus,
     error,
-    stepTimings: stepTimings2
+    stepTimings
   } = input;
   const env = getGitHubEnv();
   const runUrl = env.repository && env.runId ? `${env.serverUrl}/${env.repository}/actions/runs/${env.runId}` : null;
   const effectiveBranchName = branchName ?? input.prContext?.headBranch ?? "unknown";
   const supabaseUrl = supabase?.supabaseUrl ?? "";
-  const totalElapsed = calculateTotalElapsed(stepTimings2);
+  const totalElapsed = calculateTotalElapsed(stepTimings);
   const gitBranchName = input.prContext?.headBranch ?? branchName ?? "unknown";
   const lines = [
     ...generateProgressHeader(
@@ -8252,7 +8135,7 @@ function generateProgressCommentBody(input) {
       completedSteps,
       failedStep,
       input.skippedSteps ?? [],
-      stepTimings2,
+      stepTimings,
       schemaDrift,
       input.layerResults,
       productionPreview
@@ -8260,7 +8143,13 @@ function generateProgressCommentBody(input) {
     ...generateErrorSection(error ?? void 0, failedStep),
     ...generateTestResultsSection(input.layerResults),
     ...generateProductionSchemaSection(productionPreview, input.phase, deployStatus, env),
-    ...generateDbDeploySection(input.layerResults, gitBranchName, productionPreview, env)
+    ...generateDbDeploySection(
+      input.phase,
+      input.layerResults,
+      gitBranchName,
+      productionPreview,
+      env
+    )
   ];
   const jst = new Date(Date.now() + 9 * 60 * 60 * 1e3);
   const now = jst.toISOString().replace("T", " ").substring(0, 19);
@@ -8269,13 +8158,25 @@ function generateProgressCommentBody(input) {
 }
 
 // src/commands/ci/machine/formatters/github-comment.ts
+function getSkippedStepsForPhase(phase) {
+  switch (phase) {
+    case "test":
+      return ["syncSchema", "applySeeds", "observability"];
+    case "blocking":
+      return ["observability"];
+    case "observability":
+      return ["postSeedChecks", "staticChecks", "build", "runTests"];
+    default:
+      return [];
+  }
+}
 function createCommentInput(context, options) {
   const skippedLayerNumbers = Object.keys(context.layerSkipReasons || {}).map(Number);
   const originalSelectedLayers = [
     .../* @__PURE__ */ new Set([...skippedLayerNumbers, ...context.selectedLayers])
   ].sort((a, b) => a - b);
   return {
-    phase: context.input.phase ?? "all",
+    phase: context.phase,
     exitCode: context.exitCode,
     branchName: context.branchName,
     prContext: context.prContext,
@@ -8291,9 +8192,9 @@ function createCommentInput(context, options) {
     originalSelectedLayers
   };
 }
-function createProgressCommentInput(context, currentStep, completedSteps, failedStep = null, stepTimings2) {
-  const phase = context.input.phase ?? "all";
-  const skippedSteps = phase === "test" ? ["syncSchema", "applySeeds", "observability"] : [];
+function createProgressCommentInput(context, currentStep, completedSteps, failedStep = null, stepTimings) {
+  const phase = context.phase;
+  const skippedSteps = getSkippedStepsForPhase(phase);
   return {
     phase,
     currentStep,
@@ -8307,7 +8208,7 @@ function createProgressCommentInput(context, currentStep, completedSteps, failed
     layerResults: context.layerResults,
     productionPreview: context.productionPreview,
     error: context.error,
-    stepTimings: stepTimings2
+    stepTimings
   };
 }
 
@@ -8497,7 +8398,12 @@ function createSummaryInput(context) {
     endedAt: now,
     durationMs: Date.now() - context.startTime,
     repoKind: context.repoKind,
-    detected: {},
+    detected: {
+      ciProfile: context.input.internalProfile ?? "default",
+      requestedLayers: context.input.layers ?? [1, 2, 3, 4],
+      effectiveLayers: context.selectedLayers,
+      phase: context.phase
+    },
     diagnostics: context.diagnostics,
     steps: {},
     layers: formatLayerSummary(context.layerResults),
@@ -8634,6 +8540,12 @@ function createStaticChecksInput(context) {
     tmpDir: assertTmpDir(context)
   };
 }
+function createLayerContentInput(context) {
+  return {
+    repoRoot: assertRepoRoot(context),
+    selectedLayers: context.selectedLayers
+  };
+}
 function createBuildAndPlaywrightInput(context) {
   return {
     repoRoot: assertRepoRoot(context),
@@ -8662,8 +8574,7 @@ function createCapabilitiesInput(context) {
     repoRoot: assertRepoRoot(context),
     tmpDir: assertTmpDir(context),
     databaseUrlApp: getDatabaseUrlForRuntime(context),
-    baseUrl: context.baseUrl ?? `http://localhost:${context.app?.port ?? 3e3}`,
-    selectedLayers: context.selectedLayers
+    baseUrl: context.appStarted ? context.baseUrl ?? `http://localhost:${context.app?.port ?? 3e3}` : null
   };
 }
 function createRunCoreTestsInput(context) {
@@ -8687,19 +8598,106 @@ function deriveCoreLayerResults(output) {
   return convertLayerResults(results);
 }
 
+// src/commands/ci/machine/selectors.ts
+init_esm_shims();
+function getStateName(snapshot) {
+  return getSnapshotStateName(snapshot);
+}
+function isComplete(snapshot) {
+  return isSnapshotComplete(snapshot);
+}
+
 // src/commands/ci/machine/machine.ts
-var ciMachine = setup({
-  types: {},
-  actors: {
-    // Setup
-    localSetup: localSetupActor,
-    prLocalSetup: prLocalSetupActor,
-    // DB
-    resetDb: resetDbActor,
-    pullProduction: pullProductionActor,
-    syncSchema: syncSchemaActor,
-    applySeeds: applySeedsActor,
-    productionPreview: productionPreviewActor,
+var FLAT_EXECUTION_META = {
+  setupRoles: {
+    e2e: {
+      observable: "log",
+      assertions: [{ type: "log", contains: "Setting up database roles" }]
+    }
+  },
+  staticChecks: {
+    e2e: {
+      observable: "log",
+      assertions: [{ type: "log", contains: "Running static checks" }]
+    }
+  },
+  layerContent: {
+    e2e: {
+      observable: "log",
+      assertions: [{ type: "log", contains: "Detecting runnable layers" }]
+    }
+  },
+  buildAndPlaywright: {
+    e2e: {
+      observable: "log",
+      assertions: [
+        { type: "log", contains: "Building app" },
+        { type: "log", contains: "Installing Playwright" }
+      ]
+    }
+  },
+  appStart: {
+    e2e: {
+      observable: "log",
+      assertions: [{ type: "log", contains: "Starting app" }]
+    }
+  },
+  capabilities: {
+    e2e: {
+      observable: "log",
+      assertions: [{ type: "log", contains: "Detecting capabilities" }]
+    }
+  },
+  runCoreTests: {
+    e2e: {
+      observable: "log",
+      assertions: [{ type: "log", contains: "Running core tests" }]
+    }
+  }
+};
+function getSetupRolesApplied(output) {
+  return output.skipped !== true;
+}
+function mergeSetupRolesStepOverrides(context, output, stepId) {
+  if (output.skipped !== true) {
+    return context.stepOverrides;
+  }
+  return {
+    ...context.stepOverrides,
+    [stepId]: {
+      status: "skipped",
+      reason: output.skipReason ?? "Skipped because db:setup-roles is unavailable"
+    }
+  };
+}
+function getRunnableLayers(context, layerContent) {
+  return filterRunnableLayers(context.selectedLayers, layerContent);
+}
+function getMergedLayerSkipReasons(context, layerContent) {
+  return {
+    ...context.layerSkipReasons,
+    ...extractLayerSkipReasons(layerContent)
+  };
+}
+function getDetectedCapabilities(output) {
+  return output.detected?.capabilities ?? [];
+}
+function getCoreSuccessLayerResults(context, output, strategy) {
+  const nextResults = convertLayerResults(output.results ?? []);
+  return strategy === "merge" ? mergeLayerResults(context.layerResults, nextResults) : nextResults;
+}
+var ciMachine = setup({
+  types: {},
+  actors: {
+    // Setup
+    localSetup: localSetupActor,
+    prLocalSetup: prLocalSetupActor,
+    // DB
+    resetDb: resetDbActor,
+    pullProduction: pullProductionActor,
+    syncSchema: syncSchemaActor,
+    applySeeds: applySeedsActor,
+    productionPreview: productionPreviewActor,
     collectSchemaStats: collectSchemaStatsActor,
     setupRoles: setupRolesActor,
     installPgTap: installPgTapActor,
@@ -8710,6 +8708,7 @@ var ciMachine = setup({
     playwrightInstall: playwrightInstallActor,
     buildAndPlaywright: buildAndPlaywrightActor,
     // Test
+    layerContent: layerContentActor,
     capabilities: capabilitiesActor,
     runLayers: runLayersActor,
     // Finalize
@@ -8717,7 +8716,7 @@ var ciMachine = setup({
   },
   guards: {
     isCiLocalMode: ({ context }) => isCiLocalMode(context),
-    isCiPrLocalMode: ({ context }) => isCiPrLocalMode(context),
+    isCiPrLocalMode: ({ context }) => isCiPrMode(context),
     isCiPrMode: ({ context }) => isCiPrMode(context),
     shouldResetDb: ({ context }) => shouldResetDb(context),
     shouldPullProduction: ({ context }) => shouldPullProduction(context),
@@ -8728,6 +8727,8 @@ var ciMachine = setup({
     shouldInstallPgTap: ({ context }) => shouldInstallPgTap(context),
     shouldSetupRoles: ({ context }) => shouldSetupRoles(context),
     shouldPostGitHubComment: ({ context }) => shouldPostGitHubComment(context),
+    shouldRunPrExecutionPhase: ({ context }) => shouldRunPrExecutionPhase(context),
+    shouldRunPrObservabilityPhase: ({ context }) => shouldRunPrObservabilityPhase(context),
     isDryRun: ({ context }) => isDryRun(context),
     hasError: ({ context }) => hasError(context),
     allTestsPassed: ({ context }) => allTestsPassed(context)
@@ -9062,8 +9063,14 @@ var ciMachine = setup({
       },
       states: {
         execution: {
-          initial: "setupRoles",
+          initial: "gate",
           states: {
+            gate: {
+              always: [
+                { guard: "shouldRunPrExecutionPhase", target: "setupRoles" },
+                { target: "done" }
+              ]
+            },
             setupRoles: {
               invoke: {
                 src: "setupRoles",
@@ -9071,16 +9078,12 @@ var ciMachine = setup({
                 onDone: {
                   target: "staticChecks",
                   actions: assign({
-                    rolesSetup: ({ event }) => event.output.skipped !== true,
-                    stepOverrides: ({ context, event }) => ({
-                      ...context.stepOverrides,
-                      ...event.output.skipped ? {
-                        "postSeedPr.execution.setupRoles": {
-                          status: "skipped",
-                          reason: event.output.skipReason ?? "Skipped because db:setup-roles is unavailable"
-                        }
-                      } : {}
-                    }),
+                    rolesSetup: ({ event }) => getSetupRolesApplied(event.output),
+                    stepOverrides: ({ context, event }) => mergeSetupRolesStepOverrides(
+                      context,
+                      event.output,
+                      "postSeedPr.execution.setupRoles"
+                    ),
                     supabase: ({ context, event }) => mergeSetupRolesSupabase(context, event.output.appDatabaseUrl)
                   })
                 },
@@ -9091,7 +9094,7 @@ var ciMachine = setup({
               }
             },
             staticChecks: {
-              always: [{ guard: "shouldSkipStaticChecks", target: "buildAndPlaywright" }],
+              always: [{ guard: "shouldSkipStaticChecks", target: "layerContent" }],
               invoke: {
                 src: "staticChecks",
                 input: ({ context }) => createStaticChecksInput(context),
@@ -9105,7 +9108,7 @@ var ciMachine = setup({
                     })
                   },
                   {
-                    target: "buildAndPlaywright",
+                    target: "layerContent",
                     actions: assign({ staticChecksPassed: true })
                   }
                 ],
@@ -9118,6 +9121,22 @@ var ciMachine = setup({
                 }
               }
             },
+            layerContent: {
+              invoke: {
+                src: "layerContent",
+                input: ({ context }) => createLayerContentInput(context),
+                onDone: {
+                  target: "buildAndPlaywright",
+                  actions: assign({
+                    selectedLayers: ({ context, event }) => getRunnableLayers(context, event.output.layerContent),
+                    layerSkipReasons: ({ context, event }) => getMergedLayerSkipReasons(context, event.output.layerContent)
+                  })
+                },
+                onError: {
+                  target: "buildAndPlaywright"
+                }
+              }
+            },
             buildAndPlaywright: {
               always: [{ guard: "shouldSkipBuild", target: "appStart" }],
               invoke: {
@@ -9194,9 +9213,7 @@ var ciMachine = setup({
                 onDone: {
                   target: "runCoreTests",
                   actions: assign({
-                    capabilities: ({ event }) => event.output.detected?.capabilities ?? [],
-                    selectedLayers: ({ context, event }) => filterRunnableLayers(context.selectedLayers, event.output.layerContent),
-                    layerSkipReasons: ({ event }) => extractLayerSkipReasons(event.output.layerContent)
+                    capabilities: ({ event }) => getDetectedCapabilities(event.output)
                   })
                 },
                 onError: {
@@ -9224,10 +9241,7 @@ var ciMachine = setup({
                     target: "coreTestsComplete",
                     actions: assign({
                       testsRun: true,
-                      layerResults: ({ context, event }) => {
-                        const nextResults = convertLayerResults(event.output.results);
-                        return mergeLayerResults(context.layerResults, nextResults);
-                      }
+                      layerResults: ({ context, event }) => getCoreSuccessLayerResults(context, event.output, "merge")
                     })
                   }
                 ],
@@ -9357,8 +9371,14 @@ var ciMachine = setup({
           }
         },
         observability: {
-          initial: "productionPreview",
+          initial: "gate",
           states: {
+            gate: {
+              always: [
+                { guard: "shouldRunPrObservabilityPhase", target: "productionPreview" },
+                { target: "done" }
+              ]
+            },
             productionPreview: {
               always: [
                 {
@@ -9558,19 +9578,14 @@ var ciMachine = setup({
     // Setup Roles (ci-pr modes only)
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     setupRoles: {
-      meta: {
-        e2e: {
-          observable: "log",
-          assertions: [{ type: "log", contains: "Setting up database roles" }]
-        }
-      },
+      meta: FLAT_EXECUTION_META.setupRoles,
       invoke: {
         src: "setupRoles",
         input: ({ context }) => createSetupRolesInput(context),
         onDone: {
           target: "staticChecks",
           actions: assign({
-            rolesSetup: true,
+            rolesSetup: ({ event }) => getSetupRolesApplied(event.output),
             supabase: ({ context, event }) => mergeSetupRolesSupabase(context, event.output.appDatabaseUrl)
           })
         },
@@ -9585,13 +9600,8 @@ var ciMachine = setup({
     // Static Checks (ci-pr modes only)
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     staticChecks: {
-      meta: {
-        e2e: {
-          observable: "log",
-          assertions: [{ type: "log", contains: "Running static checks" }]
-        }
-      },
-      always: [{ guard: "shouldSkipStaticChecks", target: "buildAndPlaywright" }],
+      meta: FLAT_EXECUTION_META.staticChecks,
+      always: [{ guard: "shouldSkipStaticChecks", target: "layerContent" }],
       invoke: {
         src: "staticChecks",
         input: ({ context }) => createStaticChecksInput(context),
@@ -9605,7 +9615,7 @@ var ciMachine = setup({
             })
           },
           {
-            target: "buildAndPlaywright",
+            target: "layerContent",
             actions: assign({ staticChecksPassed: true })
           }
         ],
@@ -9618,20 +9628,29 @@ var ciMachine = setup({
         }
       }
     },
+    layerContent: {
+      meta: FLAT_EXECUTION_META.layerContent,
+      invoke: {
+        src: "layerContent",
+        input: ({ context }) => createLayerContentInput(context),
+        onDone: {
+          target: "buildAndPlaywright",
+          actions: assign({
+            selectedLayers: ({ context, event }) => getRunnableLayers(context, event.output.layerContent),
+            layerSkipReasons: ({ context, event }) => getMergedLayerSkipReasons(context, event.output.layerContent)
+          })
+        },
+        onError: {
+          target: "buildAndPlaywright"
+        }
+      }
+    },
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     // Build and Playwright Install (ci-pr modes only, parallel)
     // Optimization: Running build and playwright install concurrently saves ~30-60s
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     buildAndPlaywright: {
-      meta: {
-        e2e: {
-          observable: "log",
-          assertions: [
-            { type: "log", contains: "Building app" },
-            { type: "log", contains: "Installing Playwright" }
-          ]
-        }
-      },
+      meta: FLAT_EXECUTION_META.buildAndPlaywright,
       always: [{ guard: "shouldSkipBuild", target: "appStart" }],
       invoke: {
         src: "buildAndPlaywright",
@@ -9672,12 +9691,7 @@ var ciMachine = setup({
     // App Start (ci-pr modes only)
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     appStart: {
-      meta: {
-        e2e: {
-          observable: "log",
-          assertions: [{ type: "log", contains: "Starting app" }]
-        }
-      },
+      meta: FLAT_EXECUTION_META.appStart,
       always: [{ guard: "shouldSkipAppStart", target: "capabilities" }],
       invoke: {
         src: "appStart",
@@ -9712,26 +9726,16 @@ var ciMachine = setup({
     },
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     // Capability Detection (ci-pr modes only)
-    // Also detects layer content to filter layers without testable content
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     capabilities: {
-      meta: {
-        e2e: {
-          observable: "log",
-          assertions: [{ type: "log", contains: "Detecting capabilities" }]
-        }
-      },
+      meta: FLAT_EXECUTION_META.capabilities,
       invoke: {
         src: "capabilities",
         input: ({ context }) => createCapabilitiesInput(context),
         onDone: {
           target: "runCoreTests",
           actions: assign({
-            capabilities: ({ event }) => event.output.detected?.capabilities ?? [],
-            // Filter to runnable layers only (those with content)
-            selectedLayers: ({ context, event }) => filterRunnableLayers(context.selectedLayers, event.output.layerContent),
-            // Store skip reasons for PR comment
-            layerSkipReasons: ({ event }) => extractLayerSkipReasons(event.output.layerContent)
+            capabilities: ({ event }) => getDetectedCapabilities(event.output)
           })
         },
         onError: {
@@ -9747,12 +9751,7 @@ var ciMachine = setup({
     // ci-pr: Only core layers (1,2,3) - E2E runs in e2ePhase
     // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     runCoreTests: {
-      meta: {
-        e2e: {
-          observable: "log",
-          assertions: [{ type: "log", contains: "Running core tests" }]
-        }
-      },
+      meta: FLAT_EXECUTION_META.runCoreTests,
       invoke: {
         src: "runLayers",
         input: ({ context }) => createRunCoreTestsInput(context),
@@ -9774,7 +9773,7 @@ var ciMachine = setup({
             target: "coreTestsComplete",
             actions: assign({
               testsRun: true,
-              layerResults: ({ event }) => convertLayerResults(event.output.results)
+              layerResults: ({ context, event }) => getCoreSuccessLayerResults(context, event.output, "replace")
             })
           }
         ],
@@ -9997,18 +9996,94 @@ var ciMachine = setup({
   },
   output: ({ context }) => createOutput(context)
 });
-function getStateName(snapshot) {
-  return getSnapshotStateName(snapshot);
-}
-function isComplete(snapshot) {
-  return isSnapshotComplete(snapshot);
-}
 
 // src/commands/ci/machine/commands/machine-runner.ts
 init_esm_shims();
 
-// src/commands/ci/machine/commands/step-telemetry.ts
+// src/commands/ci/machine/commands/ci-step-registry.ts
 init_esm_shims();
+var PROGRESS_STATE_TO_STEP = {
+  setup: "setup",
+  "setup.resolving": "setup",
+  "setup.local": "setup",
+  "setup.prLocal": "setup",
+  "setup.complete": "setup",
+  dbReset: "syncSchema",
+  pullProduction: "syncSchema",
+  syncSchema: "syncSchema",
+  applySeeds: "applySeeds",
+  productionPreview: "observability",
+  collectSchemaStats: "observability",
+  postSeedPr: "postSeedChecks",
+  "postSeedPr.execution": "postSeedChecks",
+  "postSeedPr.observability": "observability",
+  "postSeedPr.execution.setupRoles": "postSeedChecks",
+  "postSeedPr.observability.productionPreview": "observability",
+  "postSeedPr.observability.collectSchemaStats": "observability",
+  "postSeedPr.execution.staticChecks": "staticChecks",
+  "postSeedPr.execution.layerContent": "build",
+  "postSeedPr.execution.buildAndPlaywright": "build",
+  "postSeedPr.execution.appStart": "build",
+  "postSeedPr.execution.capabilities": "build",
+  "postSeedPr.execution.runCoreTests": "runTests",
+  "postSeedPr.execution.coreTestsComplete": "runTests",
+  "postSeedPr.execution.coreTestsFailed": "runTests",
+  "postSeedPr.execution.e2ePhase": "runTests",
+  "postSeedPr.execution.done": "runTests",
+  decidePath: "postSeedChecks",
+  installPgTap: "applySeeds",
+  setupRoles: "postSeedChecks",
+  staticChecks: "staticChecks",
+  layerContent: "build",
+  buildAndPlaywright: "build",
+  appStart: "build",
+  capabilities: "build",
+  runTests: "runTests",
+  testsComplete: "runTests",
+  testsFailed: "runTests",
+  runCoreTests: "runTests",
+  coreTestsComplete: "runTests",
+  coreTestsFailed: "runTests",
+  e2ePhase: "runTests",
+  "e2ePhase.intermediateComment": "runTests",
+  "e2ePhase.e2eTests": "runTests",
+  finalize: "finalize",
+  "finalize.writeSummary": "finalize",
+  "finalize.postComment": "finalize",
+  "finalize.complete": "finalize",
+  done: "finalize",
+  failed: "finalize"
+};
+var PROGRESS_STEP_ORDER = [
+  "setup",
+  "syncSchema",
+  "applySeeds",
+  "postSeedChecks",
+  "observability",
+  "staticChecks",
+  "build",
+  "runTests",
+  "finalize"
+];
+var OBSERVABILITY_STEP_IDS = [
+  "postSeedPr.observability.productionPreview",
+  "postSeedPr.observability.collectSchemaStats"
+];
+var EXECUTION_STEP_IDS = [
+  "postSeedPr.execution.setupRoles",
+  "postSeedPr.execution.staticChecks",
+  "postSeedPr.execution.layerContent",
+  "postSeedPr.execution.buildAndPlaywright",
+  "postSeedPr.execution.appStart",
+  "postSeedPr.execution.capabilities",
+  "postSeedPr.execution.runCoreTests",
+  "postSeedPr.execution.e2ePhase"
+];
+var BUILD_PREPARATION_SUBSTEP_IDS = {
+  build: "postSeedPr.execution.buildAndPlaywright.build",
+  manifestGenerate: "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
+  playwrightInstall: "postSeedPr.execution.buildAndPlaywright.playwrightInstall"
+};
 var STEP_METADATA = {
   "setup.local": {
     order: 10,
@@ -10050,74 +10125,80 @@ var STEP_METADATA = {
     optional: true,
     parentStep: "applySeeds"
   },
-  "postSeedPr.observability.productionPreview": {
+  [OBSERVABILITY_STEP_IDS[0]]: {
     order: 50,
     title: "Run production preview",
     phase: "observability",
     optional: true,
     parentStep: "applySeeds"
   },
-  "postSeedPr.observability.collectSchemaStats": {
+  [OBSERVABILITY_STEP_IDS[1]]: {
     order: 60,
     title: "Collect schema statistics",
     phase: "observability",
     optional: true,
     parentStep: "applySeeds"
   },
-  "postSeedPr.execution.setupRoles": {
+  [EXECUTION_STEP_IDS[0]]: {
     order: 70,
     title: "Setup database roles",
     phase: "db",
     optional: true,
     parentStep: "applySeeds"
   },
-  "postSeedPr.execution.staticChecks": {
+  [EXECUTION_STEP_IDS[1]]: {
     order: 80,
     title: "Run static checks",
     phase: "build"
   },
-  "postSeedPr.execution.buildAndPlaywright": {
+  [EXECUTION_STEP_IDS[2]]: {
+    order: 85,
+    title: "Detect runnable test layers",
+    phase: "build",
+    optional: true
+  },
+  [EXECUTION_STEP_IDS[3]]: {
     order: 90,
     title: "Build app and prepare Playwright",
     phase: "build"
   },
-  "postSeedPr.execution.buildAndPlaywright.build": {
+  [BUILD_PREPARATION_SUBSTEP_IDS.build]: {
     order: 91,
     title: "Build application",
     phase: "build",
-    parentStep: "postSeedPr.execution.buildAndPlaywright"
+    parentStep: EXECUTION_STEP_IDS[3]
   },
-  "postSeedPr.execution.buildAndPlaywright.manifestGenerate": {
+  [BUILD_PREPARATION_SUBSTEP_IDS.manifestGenerate]: {
     order: 92,
     title: "Generate manifest",
     phase: "build",
     optional: true,
-    parentStep: "postSeedPr.execution.buildAndPlaywright"
+    parentStep: EXECUTION_STEP_IDS[3]
   },
-  "postSeedPr.execution.buildAndPlaywright.playwrightInstall": {
+  [BUILD_PREPARATION_SUBSTEP_IDS.playwrightInstall]: {
     order: 93,
     title: "Install Playwright browsers",
     phase: "build",
     optional: true,
-    parentStep: "postSeedPr.execution.buildAndPlaywright"
+    parentStep: EXECUTION_STEP_IDS[3]
   },
-  "postSeedPr.execution.appStart": {
+  [EXECUTION_STEP_IDS[4]]: {
     order: 100,
     title: "Start application",
     phase: "build"
   },
-  "postSeedPr.execution.capabilities": {
+  [EXECUTION_STEP_IDS[5]]: {
     order: 110,
     title: "Detect test capabilities",
     phase: "test",
     optional: true
   },
-  "postSeedPr.execution.runCoreTests": {
+  [EXECUTION_STEP_IDS[6]]: {
     order: 120,
     title: "Run core test layers",
     phase: "test"
   },
-  "postSeedPr.execution.e2ePhase": {
+  [EXECUTION_STEP_IDS[7]]: {
     order: 130,
     title: "Run E2E phase",
     phase: "test",
@@ -10136,10 +10217,7 @@ var STEP_METADATA = {
   }
 };
 var CANONICAL_STEP_IDS = Object.keys(STEP_METADATA).sort((a, b) => b.length - a.length);
-function toIsoString(timestampMs) {
-  return new Date(timestampMs).toISOString();
-}
-function getMetadata(stepId) {
+function getStepMetadata(stepId) {
   return STEP_METADATA[stepId];
 }
 function getCanonicalStepId(statePath) {
@@ -10155,6 +10233,12 @@ function getStepOrderFromStatePath(statePath) {
   if (!canonical) return -1;
   return STEP_METADATA[canonical]?.order ?? -1;
 }
+
+// src/commands/ci/machine/commands/step-telemetry.ts
+init_esm_shims();
+function toIsoString(timestampMs) {
+  return new Date(timestampMs).toISOString();
+}
 function pickPrimaryStatePath(statePaths, previousStatePath) {
   if (statePaths.length === 0) return previousStatePath;
   if (statePaths.length === 1 && (statePaths[0] === "done" || statePaths[0] === "failed")) {
@@ -10171,7 +10255,7 @@ function createSkippedSummary(stepId, reason) {
   return createSyntheticSummary(stepId, "skipped", { reason });
 }
 function createSyntheticSummary(stepId, status, params = {}) {
-  const metadata = getMetadata(stepId);
+  const metadata = getStepMetadata(stepId);
   if (!metadata) return null;
   const durationMs = params.startedAtMs !== void 0 && params.endedAtMs !== void 0 ? Math.max(0, params.endedAtMs - params.startedAtMs) : void 0;
   return [
@@ -10190,9 +10274,15 @@ function createSyntheticSummary(stepId, status, params = {}) {
   ];
 }
 function getBuildSkipReason(context) {
-  return isCiLocalMode(context) ? "Skipped in ci-local mode" : context.input.skipBuild === true ? "Skipped by --skip-build" : "Skipped by step guard";
+  if (!shouldRunPrExecutionPhase(context)) {
+    return getExecutionSkipReason(context);
+  }
+  return isCiLocalMode(context) ? "Skipped in ci-local mode" : context.input.skipBuild === true ? "Skipped by --skip-build" : !context.selectedLayers.some((layer) => layer === 3 || layer === 4) ? "Skipped because no build-dependent layers are selected" : "Skipped by step guard";
 }
 function getPlaywrightSkipReason(context) {
+  if (!shouldRunPrExecutionPhase(context)) {
+    return getExecutionSkipReason(context);
+  }
   if (isCiLocalMode(context)) return "Skipped in ci-local mode";
   if (!context.selectedLayers.includes(4)) return "Skipped because Layer 4 is not selected";
   if (shouldReusePreparedPlaywright(context)) {
@@ -10203,6 +10293,18 @@ function getPlaywrightSkipReason(context) {
   }
   return "Skipped by step guard";
 }
+function getObservabilitySkipReason(context) {
+  if (isTestPhase(context)) {
+    return "Skipped in phase=test; observability DB checks are disabled";
+  }
+  return "Skipped by phase selection";
+}
+function getExecutionSkipReason(context) {
+  if (isObservabilityPhase(context)) {
+    return "Skipped in phase=observability; execution work is disabled";
+  }
+  return "Skipped by phase selection";
+}
 function getSyntheticBuildEntries(context, trackedStepIds, _stepStates, _nowMs) {
   const entries = [];
   const pushEntry = (entry) => {
@@ -10210,9 +10312,15 @@ function getSyntheticBuildEntries(context, trackedStepIds, _stepStates, _nowMs)
     if (trackedStepIds.has(entry[0])) return;
     entries.push(entry);
   };
-  const syntheticTimingParams = {};
-  if (shouldSkipBuild(context)) {
-    const reason = getBuildSkipReason(context);
+  if (!shouldRunPrExecutionPhase(context)) {
+    const reason = getExecutionSkipReason(context);
+    pushEntry(createSkippedSummary(BUILD_PREPARATION_SUBSTEP_IDS.build, reason));
+    pushEntry(createSkippedSummary(BUILD_PREPARATION_SUBSTEP_IDS.manifestGenerate, reason));
+    pushEntry(createSkippedSummary(BUILD_PREPARATION_SUBSTEP_IDS.playwrightInstall, reason));
+    return entries;
+  }
+  if (!shouldRunPrExecutionPhase(context)) {
+    const reason = getExecutionSkipReason(context);
     pushEntry(createSkippedSummary("postSeedPr.execution.buildAndPlaywright.build", reason));
     pushEntry(
       createSkippedSummary("postSeedPr.execution.buildAndPlaywright.manifestGenerate", reason)
@@ -10222,106 +10330,64 @@ function getSyntheticBuildEntries(context, trackedStepIds, _stepStates, _nowMs)
     );
     return entries;
   }
+  if (shouldSkipBuild(context)) {
+    const reason = getBuildSkipReason(context);
+    pushEntry(createSkippedSummary(BUILD_PREPARATION_SUBSTEP_IDS.build, reason));
+    pushEntry(createSkippedSummary(BUILD_PREPARATION_SUBSTEP_IDS.manifestGenerate, reason));
+    pushEntry(createSkippedSummary(BUILD_PREPARATION_SUBSTEP_IDS.playwrightInstall, reason));
+    return entries;
+  }
   if (context.appBuildPassed === true) {
-    pushEntry(
-      createSyntheticSummary(
-        "postSeedPr.execution.buildAndPlaywright.build",
-        "passed",
-        syntheticTimingParams
-      )
-    );
+    pushEntry(createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.build, "passed"));
   } else if (context.appBuildPassed === false) {
     pushEntry(
-      createSyntheticSummary("postSeedPr.execution.buildAndPlaywright.build", "failed", {
-        ...syntheticTimingParams,
+      createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.build, "failed", {
         reason: context.error ?? "App build failed"
       })
     );
   }
   if (context.appBuildPassed === true) {
     if (context.manifestGenerated === true) {
-      pushEntry(
-        createSyntheticSummary(
-          "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
-          "passed",
-          syntheticTimingParams
-        )
-      );
+      pushEntry(createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.manifestGenerate, "passed"));
     } else if (context.manifestGenerated === null) {
       pushEntry(
-        createSyntheticSummary(
-          "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
-          "skipped",
-          {
-            ...syntheticTimingParams,
-            reason: "Skipped because manifest generation is optional for this repository"
-          }
-        )
+        createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.manifestGenerate, "skipped", {
+          reason: "Skipped because manifest generation is optional for this repository"
+        })
       );
     } else if (context.manifestGenerated === false) {
       pushEntry(
-        createSyntheticSummary(
-          "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
-          "failed",
-          {
-            ...syntheticTimingParams,
-            reason: "Manifest generation failed but CI continued because it is optional"
-          }
-        )
+        createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.manifestGenerate, "failed", {
+          reason: "Manifest generation failed but CI continued because it is optional"
+        })
       );
     }
   } else if (context.appBuildPassed === false) {
     pushEntry(
-      createSyntheticSummary(
-        "postSeedPr.execution.buildAndPlaywright.manifestGenerate",
-        "skipped",
-        {
-          ...syntheticTimingParams,
-          reason: "Skipped because app build failed before manifest generation"
-        }
-      )
+      createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.manifestGenerate, "skipped", {
+        reason: "Skipped because app build failed before manifest generation"
+      })
     );
   }
   if (shouldReusePreparedPlaywright(context)) {
     pushEntry(
-      createSyntheticSummary(
-        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
-        "skipped",
-        {
-          ...syntheticTimingParams,
-          reason: getPlaywrightSkipReason(context)
-        }
-      )
+      createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.playwrightInstall, "skipped", {
+        reason: getPlaywrightSkipReason(context)
+      })
     );
   } else if (shouldSkipPlaywrightInstall(context)) {
     pushEntry(
-      createSyntheticSummary(
-        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
-        "skipped",
-        {
-          ...syntheticTimingParams,
-          reason: getPlaywrightSkipReason(context)
-        }
-      )
+      createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.playwrightInstall, "skipped", {
+        reason: getPlaywrightSkipReason(context)
+      })
     );
   } else if (context.playwrightInstalled === true) {
-    pushEntry(
-      createSyntheticSummary(
-        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
-        "passed",
-        syntheticTimingParams
-      )
-    );
+    pushEntry(createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.playwrightInstall, "passed"));
   } else if (context.playwrightInstalled === false) {
     pushEntry(
-      createSyntheticSummary(
-        "postSeedPr.execution.buildAndPlaywright.playwrightInstall",
-        "failed",
-        {
-          ...syntheticTimingParams,
-          reason: "Playwright browser install failed"
-        }
-      )
+      createSyntheticSummary(BUILD_PREPARATION_SUBSTEP_IDS.playwrightInstall, "failed", {
+        reason: "Playwright browser install failed"
+      })
     );
   }
   return entries;
@@ -10333,38 +10399,43 @@ function getSkippedStepEntries(context, trackedStepIds) {
     const entry = createSkippedSummary(stepId, reason);
     if (entry) skipped.push(entry);
   };
+  if (isCiPrMode(context) && !shouldRunPrObservabilityPhase(context)) {
+    const reason = getObservabilitySkipReason(context);
+    for (const stepId of OBSERVABILITY_STEP_IDS) {
+      pushSkipped(stepId, reason);
+    }
+  }
   if (isTestPhase(context)) {
     pushSkipped("syncSchema", "Skipped in phase=test; reusing prepared database");
     pushSkipped("applySeeds", "Skipped in phase=test; reusing prepared database");
-    pushSkipped(
-      "postSeedPr.observability.productionPreview",
-      "Skipped in phase=test; observability DB checks are disabled"
-    );
-    pushSkipped(
-      "postSeedPr.observability.collectSchemaStats",
-      "Skipped in phase=test; observability DB checks are disabled"
-    );
   }
   if (!shouldPostGitHubComment(context) || context.prContext?.prNumber === null) {
     const commentReason = context.input.skipGithubComment === true ? "Skipped by --skip-github-comment" : context.executionEnv !== "github-actions" ? "Skipped outside GitHub Actions" : "Skipped because PR context is unavailable";
     pushSkipped("initialComment", commentReason);
     pushSkipped("finalize.postComment", commentReason);
   }
-  if (shouldSkipStaticChecks(context)) {
-    const reason = isCiLocalMode(context) ? "Skipped in ci-local mode" : context.input.skipStaticChecks === true ? "Skipped by --skip-static-checks" : "Skipped by step guard";
-    pushSkipped("postSeedPr.execution.staticChecks", reason);
-  }
-  if (shouldSkipBuild(context)) {
-    pushSkipped("postSeedPr.execution.buildAndPlaywright", getBuildSkipReason(context));
-  }
-  if (shouldSkipAppStart(context)) {
-    const reason = isCiLocalMode(context) ? "Skipped in ci-local mode" : !context.selectedLayers.includes(4) ? "Skipped because Layer 4 is not selected" : "Skipped by step guard";
-    pushSkipped("postSeedPr.execution.appStart", reason);
-  }
-  if (!context.selectedLayers.includes(4)) {
-    pushSkipped("postSeedPr.execution.e2ePhase", "Skipped because Layer 4 is not selected");
-  } else if (Object.values(context.layerResults).some((result) => result.status === "failed")) {
-    pushSkipped("postSeedPr.execution.e2ePhase", "Skipped because blocking core tests failed");
+  if (isCiPrMode(context) && !shouldRunPrExecutionPhase(context)) {
+    const reason = getExecutionSkipReason(context);
+    for (const stepId of EXECUTION_STEP_IDS) {
+      pushSkipped(stepId, reason);
+    }
+  } else {
+    if (shouldSkipStaticChecks(context)) {
+      const reason = isCiLocalMode(context) ? "Skipped in ci-local mode" : context.input.skipStaticChecks === true ? "Skipped by --skip-static-checks" : "Skipped by step guard";
+      pushSkipped(EXECUTION_STEP_IDS[1], reason);
+    }
+    if (shouldSkipBuild(context)) {
+      pushSkipped(EXECUTION_STEP_IDS[3], getBuildSkipReason(context));
+    }
+    if (shouldSkipAppStart(context)) {
+      const reason = isCiLocalMode(context) ? "Skipped in ci-local mode" : !context.selectedLayers.includes(4) ? "Skipped because Layer 4 is not selected" : "Skipped by step guard";
+      pushSkipped(EXECUTION_STEP_IDS[4], reason);
+    }
+    if (!context.selectedLayers.includes(4)) {
+      pushSkipped(EXECUTION_STEP_IDS[7], "Skipped because Layer 4 is not selected");
+    } else if (Object.values(context.layerResults).some((result) => result.status === "failed")) {
+      pushSkipped(EXECUTION_STEP_IDS[7], "Skipped because blocking core tests failed");
+    }
   }
   return skipped;
 }
@@ -10372,7 +10443,7 @@ function createStepTelemetryTracker() {
   const stepStates = /* @__PURE__ */ new Map();
   let activeStepIds = /* @__PURE__ */ new Set();
   const startStep = (stepId, nowMs) => {
-    const metadata = getMetadata(stepId);
+    const metadata = getStepMetadata(stepId);
     if (!metadata) return;
     if (stepStates.has(stepId)) return;
     stepStates.set(stepId, {
@@ -10411,8 +10482,7 @@ function createStepTelemetryTracker() {
           finishStep(stepId, "failed", nowMs);
           continue;
         }
-        const metadata = getMetadata(stepId);
-        finishStep(stepId, succeeded ? "passed" : metadata?.optional ? "killed" : "killed", nowMs);
+        finishStep(stepId, succeeded ? "passed" : "killed", nowMs);
       }
       activeStepIds = /* @__PURE__ */ new Set();
       const trackedEntries = [...stepStates.entries()].sort((a, b) => a[1].metadata.order - b[1].metadata.order).map(([stepId, state]) => {
@@ -10445,7 +10515,7 @@ function createStepTelemetryTracker() {
         new Set([...trackedEntries, ...skippedEntries].map(([stepId]) => stepId)));
       return Object.fromEntries(
         [...trackedEntries, ...skippedEntries, ...syntheticBuildEntries].sort(
-          ([leftStepId], [rightStepId]) => (getMetadata(leftStepId)?.order ?? Number.MAX_SAFE_INTEGER) - (getMetadata(rightStepId)?.order ?? Number.MAX_SAFE_INTEGER)
+          ([leftStepId], [rightStepId]) => (getStepMetadata(leftStepId)?.order ?? Number.MAX_SAFE_INTEGER) - (getStepMetadata(rightStepId)?.order ?? Number.MAX_SAFE_INTEGER)
         )
       );
     }
@@ -10454,17 +10524,22 @@ function createStepTelemetryTracker() {
 
 // src/commands/ci/machine/commands/machine-runner.ts
 var FLUSH_DELAY_MS = 100;
-var progressUpdateSequence = 0;
-var pendingProgressUpdate = null;
-var progressHeartbeatTimer = null;
-var latestSnapshot = null;
-var heartbeatStep = null;
-var heartbeatFailedStep = null;
-var progressUpdateSuccessCount = 0;
-var stepStartTime = Date.now();
-var currentTrackedStep = null;
-var stepTimings = {};
-var previousActiveSteps = /* @__PURE__ */ new Set();
+function createProgressState() {
+  return {
+    updateSequence: 0,
+    pendingUpdate: null,
+    heartbeatTimer: null,
+    latestSnapshot: null,
+    heartbeatStep: null,
+    heartbeatFailedStep: null,
+    updateCount: 0,
+    stepStartTime: Date.now(),
+    currentTrackedStep: null,
+    stepTimings: {},
+    previousActiveSteps: /* @__PURE__ */ new Set()
+  };
+}
+var progress = createProgressState();
 var DEFAULT_PROGRESS_HEARTBEAT_MS = 3e4;
 var HEARTBEAT_ELIGIBLE_STEPS = /* @__PURE__ */ new Set([
   "syncSchema",
@@ -10475,95 +10550,15 @@ var HEARTBEAT_ELIGIBLE_STEPS = /* @__PURE__ */ new Set([
   "runTests"
 ]);
 function resetProgressTracking() {
-  progressUpdateSequence = 0;
-  pendingProgressUpdate = null;
-  if (progressHeartbeatTimer) {
-    clearInterval(progressHeartbeatTimer);
-    progressHeartbeatTimer = null;
-  }
-  latestSnapshot = null;
-  heartbeatStep = null;
-  heartbeatFailedStep = null;
-  progressUpdateSuccessCount = 0;
-  previousActiveSteps = /* @__PURE__ */ new Set();
-  stepStartTime = Date.now();
-  currentTrackedStep = null;
-  for (const key of Object.keys(stepTimings)) {
-    delete stepTimings[key];
-  }
-}
-var STATE_TO_STEP = {
-  // Setup phase
-  setup: "setup",
-  "setup.resolving": "setup",
-  "setup.local": "setup",
-  "setup.prLocal": "setup",
-  "setup.complete": "setup",
-  // DB phase
-  dbReset: "syncSchema",
-  pullProduction: "syncSchema",
-  syncSchema: "syncSchema",
-  applySeeds: "applySeeds",
-  productionPreview: "observability",
-  collectSchemaStats: "observability",
-  postSeedPr: "postSeedChecks",
-  "postSeedPr.execution": "postSeedChecks",
-  "postSeedPr.observability": "observability",
-  "postSeedPr.execution.setupRoles": "postSeedChecks",
-  "postSeedPr.observability.productionPreview": "observability",
-  "postSeedPr.observability.collectSchemaStats": "observability",
-  "postSeedPr.execution.staticChecks": "staticChecks",
-  "postSeedPr.execution.buildAndPlaywright": "build",
-  "postSeedPr.execution.appStart": "build",
-  "postSeedPr.execution.capabilities": "build",
-  "postSeedPr.execution.runCoreTests": "runTests",
-  "postSeedPr.execution.coreTestsComplete": "runTests",
-  "postSeedPr.execution.coreTestsFailed": "runTests",
-  "postSeedPr.execution.e2ePhase": "runTests",
-  "postSeedPr.execution.done": "runTests",
-  decidePath: "postSeedChecks",
-  installPgTap: "applySeeds",
-  setupRoles: "applySeeds",
-  // Build phase
-  staticChecks: "staticChecks",
-  buildAndPlaywright: "build",
-  appStart: "build",
-  capabilities: "build",
-  // Test phase (ci-local)
-  runTests: "runTests",
-  testsComplete: "runTests",
-  testsFailed: "runTests",
-  // Test phase (ci-pr: blocking/non-blocking split)
-  runCoreTests: "runTests",
-  coreTestsComplete: "runTests",
-  coreTestsFailed: "runTests",
-  e2ePhase: "runTests",
-  "e2ePhase.intermediateComment": "runTests",
-  "e2ePhase.e2eTests": "runTests",
-  // Finalize phase
-  finalize: "finalize",
-  "finalize.writeSummary": "finalize",
-  "finalize.postComment": "finalize",
-  "finalize.complete": "finalize",
-  // Final states
-  done: "finalize",
-  failed: "finalize"
-};
-var STEP_ORDER = [
-  "setup",
-  "syncSchema",
-  "applySeeds",
-  "postSeedChecks",
-  "observability",
-  "staticChecks",
-  "build",
-  "runTests",
-  "finalize"
-];
+  if (progress.heartbeatTimer) {
+    clearInterval(progress.heartbeatTimer);
+  }
+  Object.assign(progress, createProgressState());
+}
 function resolveStepForState(state) {
   let cursor = state;
   while (cursor.length > 0) {
-    const step = STATE_TO_STEP[cursor];
+    const step = PROGRESS_STATE_TO_STEP[cursor];
     if (step) return step;
     const nextDot = cursor.lastIndexOf(".");
     if (nextDot === -1) break;
@@ -10571,20 +10566,22 @@ function resolveStepForState(state) {
   }
   return void 0;
 }
-function getCompletedSteps(currentStep, stepTimings2 = {}) {
+function getCompletedSteps(currentStep, stepTimings = {}) {
   const completed = new Set(
-    Object.keys(stepTimings2).filter((step) => STEP_ORDER.includes(step))
+    Object.keys(stepTimings).filter(
+      (step) => PROGRESS_STEP_ORDER.includes(step)
+    )
   );
   completed.delete(currentStep);
-  return STEP_ORDER.filter((step) => completed.has(step));
+  return PROGRESS_STEP_ORDER.filter((step) => completed.has(step));
 }
 function recordStepTiming(newStep) {
   const now = Date.now();
-  if (currentTrackedStep !== null) {
-    stepTimings[currentTrackedStep] = now - stepStartTime;
+  if (progress.currentTrackedStep !== null) {
+    progress.stepTimings[progress.currentTrackedStep] = now - progress.stepStartTime;
   }
-  currentTrackedStep = newStep;
-  stepStartTime = now;
+  progress.currentTrackedStep = newStep;
+  progress.stepStartTime = now;
 }
 function parseProgressHeartbeatMs(context) {
   const rawValue = context.input.progressIntervalSeconds?.trim();
@@ -10596,24 +10593,28 @@ function parseProgressHeartbeatMs(context) {
   return parsedSeconds * 1e3;
 }
 function stopProgressHeartbeat() {
-  if (progressHeartbeatTimer) {
-    clearInterval(progressHeartbeatTimer);
-    progressHeartbeatTimer = null;
+  if (progress.heartbeatTimer) {
+    clearInterval(progress.heartbeatTimer);
+    progress.heartbeatTimer = null;
   }
 }
 function refreshProgressHeartbeat(currentStep, failedStep = null) {
-  heartbeatStep = currentStep;
-  heartbeatFailedStep = failedStep;
+  progress.heartbeatStep = currentStep;
+  progress.heartbeatFailedStep = failedStep;
   stopProgressHeartbeat();
   if (!HEARTBEAT_ELIGIBLE_STEPS.has(currentStep)) {
     return;
   }
-  const intervalMs = latestSnapshot ? parseProgressHeartbeatMs(latestSnapshot.context) : DEFAULT_PROGRESS_HEARTBEAT_MS;
-  progressHeartbeatTimer = setInterval(() => {
-    if (!latestSnapshot || !heartbeatStep) return;
-    updateProgressComment(latestSnapshot.context, heartbeatStep, heartbeatFailedStep);
+  const intervalMs = progress.latestSnapshot ? parseProgressHeartbeatMs(progress.latestSnapshot.context) : DEFAULT_PROGRESS_HEARTBEAT_MS;
+  progress.heartbeatTimer = setInterval(() => {
+    if (!progress.latestSnapshot || !progress.heartbeatStep) return;
+    updateProgressComment(
+      progress.latestSnapshot.context,
+      progress.heartbeatStep,
+      progress.heartbeatFailedStep
+    );
   }, intervalMs);
-  progressHeartbeatTimer.unref?.();
+  progress.heartbeatTimer.unref?.();
 }
 function updateProgressComment(context, currentStep, failedStep = null) {
   if (!shouldPostGitHubComment(context)) return;
@@ -10622,25 +10623,26 @@ function updateProgressComment(context, currentStep, failedStep = null) {
   if (!token) return;
   const repository = process.env.GITHUB_REPOSITORY?.trim();
   if (!repository || !repository.includes("/")) return;
-  const mySeq = ++progressUpdateSequence;
+  const mySeq = ++progress.updateSequence;
+  progress.updateCount++;
   const doUpdate = async () => {
-    if (pendingProgressUpdate) {
+    if (progress.pendingUpdate) {
       try {
-        await pendingProgressUpdate;
+        await progress.pendingUpdate;
       } catch {
       }
     }
-    if (mySeq < progressUpdateSequence) {
+    if (mySeq < progress.updateSequence) {
       return;
     }
-    const freshContext = latestSnapshot?.context ?? context;
-    const completedSteps = getCompletedSteps(currentStep, stepTimings);
+    const freshContext = progress.latestSnapshot?.context ?? context;
+    const completedSteps = getCompletedSteps(currentStep, progress.stepTimings);
     const progressInput = createProgressCommentInput(
       freshContext,
       currentStep,
       completedSteps,
       failedStep,
-      { ...stepTimings }
+      { ...progress.stepTimings }
     );
     const body = `<!-- runa-ci-report -->
 ${generateProgressCommentBody(progressInput)}`;
@@ -10651,11 +10653,10 @@ ${generateProgressCommentBody(progressInput)}`;
         marker: "<!-- runa-ci-report -->",
         body
       });
-      progressUpdateSuccessCount++;
-    } catch (error) {
+    } catch {
     }
   };
-  pendingProgressUpdate = doUpdate();
+  progress.pendingUpdate = doUpdate();
 }
 function determineFailedStep(context) {
   if (context.testsRun && Object.values(context.layerResults).some((r) => r.status === "failed"))
@@ -10681,8 +10682,8 @@ function handleProgressCommentUpdate(snapshot, prevState, currentState, activeSt
   const currentStepSet = new Set(
     activeStatePaths.map((p) => resolveStepForState(p)).filter((s) => s !== void 0)
   );
-  const parallelStepChanged = !setsEqual(previousActiveSteps, currentStepSet);
-  previousActiveSteps = currentStepSet;
+  const parallelStepChanged = !setsEqual(progress.previousActiveSteps, currentStepSet);
+  progress.previousActiveSteps = currentStepSet;
   if (!currentStep || !parallelStepChanged && currentStep === prevStep && !shouldRefreshWithinStep)
     return;
   if (!shouldRefreshWithinStep) {
@@ -10725,11 +10726,10 @@ async function runCiMachine(input, logger, onStateChange) {
     let settled = false;
     const stepTelemetry = createStepTelemetryTracker();
     actor.subscribe((snapshot) => {
-      latestSnapshot = snapshot;
+      progress.latestSnapshot = snapshot;
       const activeStatePaths = getSnapshotStatePaths(snapshot);
       stepTelemetry.transition(activeStatePaths);
       const currentState = pickPrimaryStatePath(activeStatePaths, previousState) ?? activeStatePaths[0] ?? previousState ?? "unknown";
-      snapshot.status;
       if (currentState && currentState !== "done" && currentState !== "failed" && !currentState.startsWith("finalize")) {
         lastActionableState = currentState;
       }
@@ -11006,7 +11006,7 @@ init_esm_shims();
 init_esm_shims();
 var CiModeSchema = z.enum(["ci-local", "ci-pr-local"]);
 var CiExecutionEnvSchema = z.enum(["github-actions", "local"]);
-var CiPhaseSchema = z.enum(["all", "test"]);
+var CiPhaseSchema = z.enum(["all", "blocking", "observability", "test"]);
 var CiDbModeSchema = z.enum(["auto", "local"]);
 var RepoKindSchema = z.enum(["monorepo", "pj-repo", "unknown"]);
 var StepStatusSchema = z.enum(["passed", "failed", "skipped", "killed", "timeout"]);
@@ -11096,7 +11096,9 @@ z.object({
   /** Skip GitHub comment */
   skipGithubComment: z.boolean().optional(),
   /** Specific layers */
-  layers: z.array(z.number().int()).optional()
+  layers: z.array(z.number().int()).optional(),
+  /** Internal workflow-only CI profile */
+  internalProfile: z.enum(["schema-only"]).optional()
 }).passthrough();
 z.object({
   passed: z.boolean(),
@@ -11235,7 +11237,6 @@ z.object({
 });
 z.object({
   allowLocalFallback: z.boolean(),
-  allowPartialPhases: z.boolean(),
   source: z.enum(["config", "default"])
 });
 z.object({
@@ -11245,6 +11246,43 @@ z.object({
   port: z.number().int()
 });
 
+// src/commands/ci/machine/commands/ci-pr-internal-profile.ts
+init_esm_shims();
+function parseInternalLayers(raw) {
+  const values = raw.split(",").map((token) => token.trim()).filter((token) => token.length > 0);
+  if (values.length === 0) {
+    throw new Error("RUNA_CI_INTERNAL_LAYERS must include at least one layer number");
+  }
+  const layers = values.map((token) => {
+    const parsed = Number.parseInt(token, 10);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 4) {
+      throw new Error(
+        `Invalid RUNA_CI_INTERNAL_LAYERS value: "${raw}". Expected a comma-separated list of layers 1-4.`
+      );
+    }
+    return parsed;
+  });
+  return Array.from(new Set(layers)).sort((a, b) => a - b);
+}
+function resolveInternalCiOverrides(env = process.env) {
+  const profileRaw = env.RUNA_CI_INTERNAL_PROFILE?.trim();
+  const layersRaw = env.RUNA_CI_INTERNAL_LAYERS?.trim();
+  if (!profileRaw && !layersRaw) {
+    return {};
+  }
+  let profile;
+  if (profileRaw) {
+    if (profileRaw !== "schema-only") {
+      throw new Error(
+        `Unsupported RUNA_CI_INTERNAL_PROFILE value: "${profileRaw}". Expected "schema-only".`
+      );
+    }
+    profile = profileRaw;
+  }
+  const layers = layersRaw ? parseInternalLayers(layersRaw) : profile === "schema-only" ? [2] : void 0;
+  return { profile, layers };
+}
+
 // src/commands/ci/machine/commands/ci-pr.ts
 var cliOutputFormat = "human";
 var isGitHubActionsMode2 = false;
@@ -11299,6 +11337,73 @@ function logSetupRolesStatus(ctx, logger) {
   }
 }
 var CI_PR_UNKNOWN_STATE_LOG_SKIP = /* @__PURE__ */ new Set(["decidePath", "done", "failed"]);
+var logStaticChecks = (ctx, logger) => {
+  logSetupRolesStatus(ctx, logger);
+  logSection3("Static Checks: type-check + lint (parallel)");
+  logger.info("Running: pnpm type-check || pnpm lint");
+};
+var logBuildAndPlaywright = (ctx, logger) => {
+  if (ctx.staticChecksPassed) {
+    logger.success("Static checks passed");
+  }
+  if (shouldReusePreparedPlaywright(ctx)) {
+    logSection3("Build: App Build + Reuse Prepared Playwright");
+    logger.info("Running: pnpm build (Playwright install owned by outer workflow)");
+    return;
+  }
+  logSection3("Build: App Build + Playwright Install (parallel)");
+  logger.info("Running: pnpm build || pnpm exec playwright install chromium");
+};
+var logLayerContent = (ctx, logger) => {
+  if (ctx.staticChecksPassed) {
+    logger.success("Static checks passed");
+  }
+  logSection3("Detect Runnable Layers");
+  logger.info(`Selected layers before filtering: ${ctx.selectedLayers.join(", ")}`);
+};
+var logAppStart = (ctx, logger) => {
+  if (ctx.appBuildPassed) {
+    logger.success("App build completed");
+  }
+  if (ctx.manifestGenerated) {
+    logger.success("Manifest generated (Layer 3 ready)");
+  } else if (ctx.manifestGenerated === null) {
+    logger.info("Manifest generation skipped (optional)");
+  } else if (ctx.manifestGenerated === false) {
+    logger.warn("Manifest generation failed (Layer 3 may be skipped)");
+  }
+  if (ctx.playwrightInstalled) {
+    logger.success("Playwright browsers installed");
+  }
+  logSection3("Start Application");
+  logger.info(`Starting app on port ${ctx.app?.port ?? 3e3}...`);
+};
+var logCapabilities = (ctx, logger) => {
+  if (ctx.appStarted) {
+    logger.success(`App started at ${ctx.baseUrl ?? "http://localhost:3000"}`);
+  }
+  logSection3("Detect Test Capabilities");
+};
+var logRunCoreTests = (ctx, logger) => {
+  const coreLayers = ctx.selectedLayers.filter((l) => l !== 4);
+  logSection3(`Core Tests: Layer ${coreLayers.join(", ")}`);
+  logger.info(`Running core layers: ${coreLayers.map((l) => `test layer${l}`).join(", ")}`);
+};
+var logCollectSchemaStats = (ctx, logger) => {
+  if (ctx.productionPreview?.executed) {
+    if (ctx.productionPreview.hasChanges) {
+      logger.info("Production preview: schema changes detected");
+    } else {
+      logger.success("Production preview: no schema changes");
+    }
+  }
+  logSection3("Database: Collect Schema Statistics");
+  logger.info("Comparing Local/CI/Production schemas...");
+};
+var logE2ePhase = (_ctx, logger) => {
+  logSection3("E2E Phase: Layer 4 + Intermediate Comment");
+  logger.info("Running Layer 4 E2E tests (parallel with intermediate PR comment)");
+};
 var stateLogHandlers2 = {
   // ─── Setup Phase ───────────────────────────────────────────
   setup: (_ctx, _logger) => {
@@ -11319,9 +11424,12 @@ var stateLogHandlers2 = {
     logger.info("Posting initial CI progress comment to PR...");
   },
   // ─── Database Phase ────────────────────────────────────────
-  syncSchema: (_ctx, logger) => {
-    logSection3("Database: Apply Schema (db apply)");
-    logger.info("Running: pnpm exec runa db apply preview --verbose");
+  syncSchema: (ctx, logger) => {
+    const isCiLocalMode2 = ctx.mode === "ci-local";
+    logSection3(`Database: Apply Schema (${isCiLocalMode2 ? "db sync" : "db apply --no-seed"})`);
+    logger.info(
+      isCiLocalMode2 ? "Running: pnpm exec runa db sync local --verbose" : "Running: pnpm exec runa db apply preview --no-seed --verbose"
+    );
   },
   applySeeds: (ctx, logger) => {
     if (ctx.schemaApplied) {
@@ -11330,6 +11438,7 @@ var stateLogHandlers2 = {
     logSection3("Database: Apply Seeds (db seed)");
     logger.info("Running: pnpm exec runa db seed ci --auto-approve");
   },
+  // Nested paths (postSeedPr.*) — differ from flat counterparts
   "postSeedPr.execution.setupRoles": (ctx, logger) => {
     if (ctx.seedsApplied) {
       logger.success("Seeds applied successfully");
@@ -11342,68 +11451,18 @@ var stateLogHandlers2 = {
       logger.success("Seeds applied successfully");
     }
     logSection3("Database: Production Preview (dry-run)");
-    logger.info("Running: pnpm exec runa db apply production --check --compare-only");
-  },
-  "postSeedPr.observability.collectSchemaStats": (ctx, logger) => {
-    if (ctx.productionPreview?.executed) {
-      if (ctx.productionPreview.hasChanges) {
-        logger.info("Production preview: schema changes detected");
-      } else {
-        logger.success("Production preview: no schema changes");
-      }
-    }
-    logSection3("Database: Collect Schema Statistics");
-    logger.info("Comparing Local/CI/Production schemas...");
-  },
-  "postSeedPr.execution.staticChecks": (ctx, logger) => {
-    logSetupRolesStatus(ctx, logger);
-    logSection3("Static Checks: type-check + lint (parallel)");
-    logger.info("Running: pnpm type-check || pnpm lint");
-  },
-  "postSeedPr.execution.buildAndPlaywright": (ctx, logger) => {
-    if (ctx.staticChecksPassed) {
-      logger.success("Static checks passed");
-    }
-    if (shouldReusePreparedPlaywright(ctx)) {
-      logSection3("Build: App Build + Reuse Prepared Playwright");
-      logger.info("Running: pnpm build (Playwright install owned by outer workflow)");
-      return;
-    }
-    logSection3("Build: App Build + Playwright Install (parallel)");
-    logger.info("Running: pnpm build || pnpm exec playwright install chromium");
-  },
-  "postSeedPr.execution.appStart": (ctx, logger) => {
-    if (ctx.appBuildPassed) {
-      logger.success("App build completed");
-    }
-    if (ctx.manifestGenerated) {
-      logger.success("Manifest generated (Layer 3 ready)");
-    } else if (ctx.manifestGenerated === null) {
-      logger.info("Manifest generation skipped (optional)");
-    } else if (ctx.manifestGenerated === false) {
-      logger.warn("Manifest generation failed (Layer 3 may be skipped)");
-    }
-    if (ctx.playwrightInstalled) {
-      logger.success("Playwright browsers installed");
-    }
-    logSection3("Start Application");
-    logger.info(`Starting app on port ${ctx.app?.port ?? 3e3}...`);
-  },
-  "postSeedPr.execution.capabilities": (ctx, logger) => {
-    if (ctx.appStarted) {
-      logger.success(`App started at ${ctx.baseUrl ?? "http://localhost:3000"}`);
-    }
-    logSection3("Detect Test Capabilities");
-  },
-  "postSeedPr.execution.runCoreTests": (ctx, logger) => {
-    const coreLayers = ctx.selectedLayers.filter((l) => l !== 4);
-    logSection3(`Core Tests: Layer ${coreLayers.join(", ")}`);
-    logger.info(`Running core layers: ${coreLayers.map((l) => `test layer${l}`).join(", ")}`);
-  },
-  "postSeedPr.execution.e2ePhase": (_ctx, logger) => {
-    logSection3("E2E Phase: Layer 4 + Intermediate Comment");
-    logger.info("Running Layer 4 E2E tests (parallel with intermediate PR comment)");
+    logger.info("Running: pnpm exec runa db preview production --profile compare-only");
   },
+  // Shared handlers (nested paths alias to same handler as flat paths)
+  "postSeedPr.observability.collectSchemaStats": logCollectSchemaStats,
+  "postSeedPr.execution.staticChecks": logStaticChecks,
+  "postSeedPr.execution.layerContent": logLayerContent,
+  "postSeedPr.execution.buildAndPlaywright": logBuildAndPlaywright,
+  "postSeedPr.execution.appStart": logAppStart,
+  "postSeedPr.execution.capabilities": logCapabilities,
+  "postSeedPr.execution.runCoreTests": logRunCoreTests,
+  "postSeedPr.execution.e2ePhase": logE2ePhase,
+  // Flat paths (differ from nested counterparts)
   productionPreview: (ctx, logger) => {
     if (ctx.seedsApplied) {
       logger.success("Seeds applied successfully");
@@ -11411,19 +11470,9 @@ var stateLogHandlers2 = {
       logger.info("Seeds skipped (no seed files or already seeded)");
     }
     logSection3("Database: Production Preview (dry-run)");
-    logger.info("Running: pnpm exec runa db apply production --check --compare-only");
-  },
-  collectSchemaStats: (ctx, logger) => {
-    if (ctx.productionPreview?.executed) {
-      if (ctx.productionPreview.hasChanges) {
-        logger.info("Production preview: schema changes detected");
-      } else {
-        logger.success("Production preview: no schema changes");
-      }
-    }
-    logSection3("Database: Collect Schema Statistics");
-    logger.info("Comparing Local/CI/Production schemas...");
+    logger.info("Running: pnpm exec runa db preview production --profile compare-only");
   },
+  collectSchemaStats: logCollectSchemaStats,
   setupRoles: (ctx, logger) => {
     if (ctx.schemaStats) {
       logger.success("Schema statistics collected");
@@ -11432,57 +11481,18 @@ var stateLogHandlers2 = {
     logger.info("Running: pnpm db:setup-roles");
   },
   // ─── Static Analysis Phase ─────────────────────────────────
-  staticChecks: (ctx, logger) => {
-    logSetupRolesStatus(ctx, logger);
-    logSection3("Static Checks: type-check + lint (parallel)");
-    logger.info("Running: pnpm type-check || pnpm lint");
-  },
+  staticChecks: logStaticChecks,
   // ─── Build Phase ───────────────────────────────────────────
-  buildAndPlaywright: (ctx, logger) => {
-    if (ctx.staticChecksPassed) {
-      logger.success("Static checks passed");
-    }
-    if (shouldReusePreparedPlaywright(ctx)) {
-      logSection3("Build: App Build + Reuse Prepared Playwright");
-      logger.info("Running: pnpm build (Playwright install owned by outer workflow)");
-      return;
-    }
-    logSection3("Build: App Build + Playwright Install (parallel)");
-    logger.info("Running: pnpm build || pnpm exec playwright install chromium");
-  },
-  appStart: (ctx, logger) => {
-    if (ctx.appBuildPassed) {
-      logger.success("App build completed");
-    }
-    if (ctx.manifestGenerated) {
-      logger.success("Manifest generated (Layer 3 ready)");
-    } else if (ctx.manifestGenerated === null) {
-      logger.info("Manifest generation skipped (optional)");
-    } else if (ctx.manifestGenerated === false) {
-      logger.warn("Manifest generation failed (Layer 3 may be skipped)");
-    }
-    if (ctx.playwrightInstalled) {
-      logger.success("Playwright browsers installed");
-    }
-    logSection3("Start Application");
-    logger.info(`Starting app on port ${ctx.app?.port ?? 3e3}...`);
-  },
+  layerContent: logLayerContent,
+  buildAndPlaywright: logBuildAndPlaywright,
+  appStart: logAppStart,
   // ─── Test Phase ────────────────────────────────────────────
-  capabilities: (ctx, logger) => {
-    if (ctx.appStarted) {
-      logger.success(`App started at ${ctx.baseUrl ?? "http://localhost:3000"}`);
-    }
-    logSection3("Detect Test Capabilities");
-  },
+  capabilities: logCapabilities,
   runTests: (ctx, logger) => {
     logSection3(`Run Tests: Layer ${ctx.selectedLayers.join(", ")}`);
     logger.info(`Running layers: ${ctx.selectedLayers.map((l) => `test layer${l}`).join(", ")}`);
   },
-  runCoreTests: (ctx, logger) => {
-    const coreLayers = ctx.selectedLayers.filter((l) => l !== 4);
-    logSection3(`Core Tests: Layer ${coreLayers.join(", ")}`);
-    logger.info(`Running core layers: ${coreLayers.map((l) => `test layer${l}`).join(", ")}`);
-  },
+  runCoreTests: logRunCoreTests,
   coreTestsComplete: (ctx, logger) => {
     const coreLayers = ctx.selectedLayers.filter((l) => l !== 4);
     const passedLayers = coreLayers.filter(
@@ -11496,10 +11506,7 @@ var stateLogHandlers2 = {
     const failedLayers = Object.entries(ctx.layerResults).filter(([_, result]) => result.status === "failed").map(([layer]) => layer);
     logger.error(`Core tests failed: Layer ${failedLayers.join(", ")}`);
   },
-  e2ePhase: (_ctx, logger) => {
-    logSection3("E2E Phase: Layer 4 + Intermediate Comment");
-    logger.info("Running Layer 4 E2E tests (parallel with intermediate PR comment)");
-  },
+  e2ePhase: logE2ePhase,
   "e2ePhase.e2eTests": (_ctx, logger) => {
     logger.info("Running Layer 4 E2E tests...");
   },
@@ -11565,7 +11572,7 @@ function getGitHubEventAction() {
     return void 0;
   }
 }
-function optionsToMachineInput(options) {
+function optionsToMachineInput(options, internalOverrides) {
   return {
     command: "pr",
     // Explicit command for mode detection
@@ -11586,7 +11593,8 @@ function optionsToMachineInput(options) {
     skipGithubComment: options.skipGithubComment,
     verbose: options.verbose,
     targetDir: process.cwd(),
-    layers: [1, 2, 3, 4],
+    layers: internalOverrides.layers,
+    internalProfile: internalOverrides.profile,
     // Environment capture (Environment Capture Pattern: capture at entry point, not in machine/guards)
     databaseUrl: options.databaseUrl ?? process.env.DATABASE_URL,
     // PRD: GH_DATABASE_URL_ADMIN = postgres role (DDL capable, for pg-schema-diff dry-run)
@@ -11614,36 +11622,47 @@ async function runCiPrCommand(options) {
   const skipStaticChecks = options.skipStaticChecks === true;
   const skipBuild = options.skipBuild === true;
   const phase = options.phase ?? "all";
+  const blockingPhase = phase === "blocking";
+  const observabilityPhase = phase === "observability";
   const testOnlyPhase = phase === "test";
+  const runExecutionPath = !observabilityPhase;
   const preparedRuntime = options.skipLocalDbStart === true || options.assumeSupabaseReady === true;
   const preparedPlaywright = options.skipPlaywrightInstall === true;
+  const dbDescription = testOnlyPhase ? "Skip schema apply/seed and reuse the prepared database" : observabilityPhase ? "db apply \u2192 db seed \u2192 production preview \u2192 schema stats" : blockingPhase ? "db apply \u2192 db seed \u2192 (production preview \u2225 schema stats \u2225 db:setup-roles)" : "db apply \u2192 db seed \u2192 (production preview \u2225 schema stats \u2225 db:setup-roles)";
   const planSteps = [
     {
       id: "setup",
       description: testOnlyPhase ? "Resolve repo/app context (optionally reuse pre-started local Supabase)" : preparedRuntime ? "Reuse workflow-prepared local Supabase runtime" : "Start local Supabase instance"
     },
-    ...testOnlyPhase ? [{ id: "db", description: "Skip schema apply/seed and reuse the prepared database" }] : [
+    { id: "db", description: dbDescription },
+    ...!runExecutionPath || skipStaticChecks ? [] : [{ id: "static", description: "pnpm type-check + pnpm lint (parallel)" }],
+    ...!runExecutionPath || skipBuild ? [] : [
       {
-        id: "db",
-        description: "db apply \u2192 db seed \u2192 (production preview \u2225 schema stats \u2225 db:setup-roles)"
+        id: "build",
+        description: preparedPlaywright ? "Detect runnable layers \u2192 pnpm build \u2192 manifest:generate (reuse preinstalled Playwright)" : "Detect runnable layers \u2192 pnpm build \u2192 manifest:generate + playwright install"
       }
     ],
-    ...skipStaticChecks ? [] : [{ id: "static", description: "pnpm type-check + pnpm lint (parallel)" }],
-    ...skipBuild ? [] : [
+    ...!runExecutionPath ? [] : [
       {
-        id: "build",
-        description: preparedPlaywright ? "pnpm build \u2192 manifest:generate (reuse preinstalled Playwright)" : "pnpm build \u2192 manifest:generate + playwright install"
+        id: "test",
+        description: "Start app if Layer 4 is runnable \u2192 detect capabilities \u2192 run layers"
       }
     ],
-    { id: "test", description: "Start app \u2192 detect capabilities \u2192 run layers 1-4" },
     {
       id: "finalize",
       description: "Write ci-summary.json + post GitHub comment"
     }
   ];
   logPlan2(planSteps);
-  const machineInput = optionsToMachineInput(options);
   try {
+    const internalOverrides = resolveInternalCiOverrides();
+    if (internalOverrides.profile && outputFormat !== "json") {
+      logger.info(`Internal CI profile: ${internalOverrides.profile}`);
+      if (internalOverrides.layers) {
+        logger.info(`Internal CI layers: ${internalOverrides.layers.join(", ")}`);
+      }
+    }
+    const machineInput = optionsToMachineInput(options, internalOverrides);
     const result = await runCiMachine(machineInput, logger, handleStateChange2);
     endCurrentGroup2();
     printSummary2(logger, result);