emdash 0.33.0 → 0.35.0

package/dist/astro/middleware.mjs

@@ -1,94 +1,107 @@
-import { a as runMigrations, n as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "../runner-BFTrkYhu.mjs";
-import { c as isSqlite, u as listTablesLike } from "../dialect-helpers-BSbfaO3F.mjs";
-import { a as setI18nConfig, n as getI18nConfig } from "../config-DyF3OKg_.mjs";
-import { D as AuditRepository, b as definePlugin, g as EmailPipeline, h as parseRouteInput, m as buildRouteMeta, p as PluginRouteRegistry, t as getMenu, v as createHookPipeline, y as resolveExclusiveHooks } from "../menus-Y54RDPIN.mjs";
+import { r as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "../runner-C1T11CfC.mjs";
+import { t as validateIdentifier } from "../validate-BpwoDOgt.mjs";
+import { c as isSqlite, p as tableExists, s as isPostgres, u as listTablesLike } from "../dialect-helpers-BSbfaO3F.mjs";
+import { r as getI18nConfig, s as setI18nConfig } from "../config-C3EBstHi.mjs";
+import { C as createHookPipeline, M as AuditRepository, T as definePlugin, _ as PluginRouteRegistry, b as toRouteCallerInfo, c as getSandboxRouteErrorDetails, t as getMenu, v as buildRouteMeta, w as resolveExclusiveHooks, x as EmailPipeline, y as parseRouteInput } from "../menus-DSo5QeW0.mjs";
 import { n as createDeferredTaskTracker, t as after } from "../after-CBU2vkoO.mjs";
 import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
 import { o as getLastContentWriteAt } from "../object-cache-71tPfV4A.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "../content-CJ94NEx5.mjs";
-import { n as isMissingTableError } from "../db-errors-CcWLaRiR.mjs";
-import "../base64-B-PsqheR.mjs";
-import { t as ContentMutationConflictError } from "../types-Cd8iuS1J.mjs";
-import { t as MediaRepository } from "../media-BP7S-nHT.mjs";
-import "../user-DBrq4UVq.mjs";
-import "../taxonomy-pOrB2kZe.mjs";
-import "../comment-BIkJ6Fil.mjs";
+import { i as MAX_COLLECTION_LIST_COLUMNS } from "../types-75KIqzL9.mjs";
+import { i as RevisionRepository, t as ContentRepository } from "../content-ZHCc1ngN.mjs";
+import { n as isMissingTableError } from "../db-errors-Cl-sKYTm.mjs";
+import "../slugify-B994zkXC.mjs";
+import "../base64-CvLhUKQv.mjs";
+import { n as ContentMutationConflictError } from "../types-CQPWhPxE.mjs";
+import { t as MediaRepository } from "../media-CzhAn2--.mjs";
+import "../user-DJZfUJVE.mjs";
+import { t as withTransaction } from "../transaction-NQj4VJ7Z.mjs";
+import "../taxonomy-BqCZ1TdU.mjs";
+import "../comment-Dxlep6cE.mjs";
 import { t as OptionsRepository } from "../options-CBXIHUoT.mjs";
-import { r as createSiteInfo } from "../context-C_1nrqnW.mjs";
-import "../menus-BcQWxeXu.mjs";
-import "../redirect-DIJxXKOG.mjs";
+import { r as createSiteInfo } from "../context-ZldbZcle.mjs";
+import "../menus-TCNSd2vp.mjs";
+import "../redirect-COsS6SWJ.mjs";
 import { i as setRequestCacheEntry, r as requestCached } from "../request-cache-BSUptuJR.mjs";
-import "../byline-registry-ZkPKqEwC.mjs";
-import { n as initWithLock, t as createInitLock } from "../init-lock-DJkX6Hto.mjs";
-import "../field-defs-cache-WD82dMQq.mjs";
-import "../byline-Cp6csL84.mjs";
-import "../relation-Cbe3Sd3m.mjs";
-import { n as normalizeMediaValue } from "../normalize-C-SHXmra.mjs";
-import "../enrich-CFJJgxs_.mjs";
-import "../seo-DTHRntNC.mjs";
-import { r as singleFlightCached, t as createSingleFlightCache } from "../single-flight-cache-DW3w11Pu.mjs";
-import "../cache-C9FptTFR.mjs";
-import { t as FTSManager } from "../fts-manager-BITakW_R.mjs";
-import "../resolve-DZzG4HqM.mjs";
+import "../byline-registry-DDun8sxh.mjs";
+import { n as initWithLock, t as createInitLock } from "../init-lock-6b309ZrF.mjs";
+import "../field-defs-cache-BzwBlJrR.mjs";
+import "../byline-yjvWq4ip.mjs";
+import "../relation-BnHB0T4J.mjs";
+import { n as normalizeMediaValue } from "../normalize-Bc-s_r-a.mjs";
+import "../dist-D_6CKR8z.mjs";
+import "../enrich-_ySMEvEE.mjs";
+import "../seo-Dq4G-RrO.mjs";
+import { r as singleFlightCached, t as createSingleFlightCache } from "../single-flight-cache-B0eLKS6K.mjs";
+import "../cache-C46-3Irl.mjs";
+import { t as FTSManager } from "../fts-manager-DyZEohZC.mjs";
+import "../resolve-DOhVEvty.mjs";
 import { createRecorder, flushRecorder, isInstrumentationEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
-import { o as getDb } from "../loader-CGugY7Zl.mjs";
-import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-CLN1N92E.mjs";
-import { $ as handleContentDelete, B as handleMediaDelete, G as handleRevisionList, H as handleMediaList, J as handleContentAuthors, K as handleRevisionRestore, Q as handleContentCreate, U as handleMediaUpdate, V as handleMediaGet, W as handleRevisionGet, X as handleContentCountScheduled, Y as handleContentCompare, Z as handleContentCountTrashed, _ as loadBundleFromR2, at as handleContentListTrashed, ct as handleContentRestore, dt as handleContentUnpublish, et as handleContentDiscardDraft, ft as handleContentUnschedule, it as handleContentList, lt as handleContentSchedule, mt as validateRev, nt as handleContentGet, ot as handleContentPermanentDelete, pt as handleContentUpdate, rt as handleContentGetIncludingTrashed, s as normalizeRegistryConfig, st as handleContentPublish, tt as handleContentDuplicate, ut as handleContentTranslations, v as syncDeclaredStorageIndexes, z as handleMediaCreate } from "../api-D2hunekQ.mjs";
-import "../dashboard-DINnNVVU.mjs";
+import { s as getDb } from "../loader-CdG_Ci3H.mjs";
+import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-BlrncHi9.mjs";
+import { $ as handleContentUnschedule, A as handleMediaUpdate, B as handleContentDelete, D as handleMediaDelete, E as handleMediaCreate, F as handleContentAuthors, G as handleContentList, H as handleContentDuplicate, I as handleContentCompare, J as handleContentPublish, K as handleContentListTrashed, L as handleContentCountScheduled, M as handleRevisionList, N as handleRevisionRestore, O as handleMediaGet, Q as handleContentUnpublish, R as handleContentCountTrashed, U as handleContentGet, V as handleContentDiscardDraft, W as handleContentGetIncludingTrashed, X as handleContentSchedule, Y as handleContentRestore, Z as handleContentTranslations, _ as loadBundleFromR2, et as handleContentUpdate, j as handleRevisionGet, k as handleMediaList, q as handleContentPermanentDelete, s as normalizeRegistryConfig, tt as validateRev, v as syncDeclaredStorageIndexes, z as handleContentCreate } from "../api-BeBglVxU.mjs";
+import { n as recordSchedulerHeartbeatSafely } from "../dashboard-DvHbk_cv.mjs";
 import { r as hashString } from "../hash-Cg0TXJPV.mjs";
-import { a as findNonTranslatableSiblingContentIds, c as refreshContentMediaUsageAfterWrite, g as MediaUsageRepository, o as markContentMediaUsageCollectionStale, r as deleteContentMediaUsage } from "../content-refresh-Xw7aKmou.mjs";
-import "../media-usage-BlxfTkN0.mjs";
-import { n as SchemaRegistry } from "../registry-Dbodb4Uo.mjs";
-import "../query-rC9HKv1N.mjs";
-import "../zod-generator-CG64Hnbh.mjs";
-import "../schema-CiQXr6_F.mjs";
-import "../seo-CobNfOvb.mjs";
-import { t as PluginStateRepository } from "../state-CQvoefYP.mjs";
-import "../sections-BrIrMUCn.mjs";
-import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-kJhGiQ4z.mjs";
-import "../settings-DPHau-WH.mjs";
-import "../taxonomies-CKuaZER5.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-Da7kj23y.mjs";
-import "../types-DKuWPYV5.mjs";
-import "../ssrf-CTa6v21i.mjs";
-import "../error-oh_9i6bR.mjs";
-import "../parse-CJKNuewM.mjs";
-import "../media-OhYL-7Io.mjs";
-import "../redirects-G8wAhWAf.mjs";
-import "../relations-Bw_E1TXo.mjs";
-import "../status-CIsmlC1E.mjs";
-import { a as invalidateUrlPatternCache } from "../query-C5w7PsRQ.mjs";
-import "../import-C-9uqyT3.mjs";
-import { t as getTrustedProxyHeaders } from "../trusted-proxy-D20_7fyX.mjs";
-import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-Df-jFbAd.mjs";
-import "../ssrf-Cj568Dgs.mjs";
-import { n as CronExecutor } from "../cron-DRV-UC4K.mjs";
-import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-C6WdcWbL.mjs";
-import "../utils-hLzi_2Fn.mjs";
-import "../tokens-DagaJGK8.mjs";
-import "../preview-BU6PaLpM.mjs";
-import "../hreflang-BdZuVBhL.mjs";
-import "../comment-reaction-D-laEceb.mjs";
-import "../bylines-CEj5CdT4.mjs";
-import { n as getWidgetAreas } from "../widgets-CJJtkiKh.mjs";
-import "../validate-mKo3RxBM.mjs";
-import "../apply-kwNEJW2l.mjs";
-import "../load-DV1DZuUJ.mjs";
-import "../search-FZhx5dDU.mjs";
+import { _ as loadContentMediaUsageFields, a as findNonTranslatableSiblingContentIds, g as buildContentMediaUsageFieldFingerprint, l as refreshContentMediaUsageAfterWrite, r as deleteContentMediaUsage, s as markContentMediaUsageCollectionStale, u as refreshContentMediaUsageForWork, v as CONTENT_SOURCE_SCHEMA_VERSION, y as MediaUsageRepository } from "../content-refresh-B_8SJzuU.mjs";
+import { t as MediaUsageWorkRepository } from "../media-usage-work-DrCbqBcl.mjs";
+import "../media-usage-BZCydfvu.mjs";
+import { n as collectionDeletionCurrentTimestamp, r as deleteActivatedMediaUsageCollection, t as MediaUsageCollectionDeletionRepository } from "../collection-deletion-DQPvMD8R.mjs";
+import "../media-usage-work-CLo_6tct.mjs";
+import { n as SchemaRegistry } from "../registry-Cqa2I749.mjs";
+import "../query-BWs7O5Il.mjs";
+import "../zod-generator-LC-on_Vb.mjs";
+import "../schema-DZ5YVVZj.mjs";
+import "../schema-2AOsSn2v.mjs";
+import "../seo-AFpVvTqr.mjs";
+import { t as PluginStateRepository } from "../state-DYwPue40.mjs";
+import "../sections-DmHviGyM.mjs";
+import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-xRdoUZr0.mjs";
+import "../settings-DE9xtzqd.mjs";
+import "../taxonomies-OHUIiIpI.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-BXbUAHod.mjs";
+import "../types-CP1CflWf.mjs";
+import "../ssrf-Cpvg_n3A.mjs";
+import "../error-DupyJZE2.mjs";
+import "../parse-DFbuc-Fh.mjs";
+import "../media-BWWWb8kg.mjs";
+import "../redirects-DTDHWH31.mjs";
+import "../relations-BBApI4e2.mjs";
+import "../status-CWVYpbD8.mjs";
+import { a as invalidateUrlPatternCache } from "../query-zTVAR1Sl.mjs";
+import "../import-DPkLmeXO.mjs";
+import { t as getTrustedProxyHeaders } from "../trusted-proxy-CEVekpby.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DgZJh3zG.mjs";
+import "../ssrf-DpXgKsna.mjs";
+import { n as CronExecutor } from "../cron-Y9aLtgrA.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-BHNjIwiB.mjs";
+import { n as assertMediaUsageActivationWriteAllowed } from "../media-usage-write-fence-aHEgN1zB.mjs";
+import "../utils-D4vD_Y98.mjs";
+import "../tokens-C39klX8R.mjs";
+import "../preview-PW-nOnq4.mjs";
+import "../hreflang-BBe83kKa.mjs";
+import "../comment-reaction-D-2J84UE.mjs";
+import "../bylines-DjXS5p0P.mjs";
+import { n as getWidgetAreas } from "../widgets-BD3ho7Rq.mjs";
+import "../validate-BMLBvxOC.mjs";
+import "../apply-kUDt80-G.mjs";
+import "../load-YJ2xl3ra.mjs";
+import "../search-u1QYdOCG.mjs";
 import "../index.mjs";
-import { n as VERSION, t as COMMIT } from "../version-C4PnpmoV.mjs";
-import { t as getAuthMode } from "../mode-BWyTBe3I.mjs";
-import "../snapshot-I_fjLDaD.mjs";
-import { u as maybeRunScheduledBackup } from "../backup-CtA6LDNw.mjs";
-import { t as cleanupExpiredChallenges } from "../challenge-store-D9VNKELo.mjs";
-import { t as removeUploadAttempt } from "../upload-attempts-D8QAFLUJ.mjs";
-import { a as validateEncryptionKeyAtStartup } from "../secrets-DLd8RXee.mjs";
+import { i as resolveRuntimeMigrationMode, n as enforceRuntimeMigrationPolicy, t as PendingMigrationsError } from "../policy-TluUIxuu.mjs";
+import { n as VERSION, t as COMMIT } from "../version-DB_fqCSI.mjs";
+import { t as getAuthMode } from "../mode-BDoH_WcF.mjs";
+import "../snapshot-BBlGkb2q.mjs";
+import { u as maybeRunScheduledBackup } from "../backup-DWYpJlLj.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-SIL5DsF2.mjs";
+import { t as removeUploadAttempt } from "../upload-attempts-D4FS8LT6.mjs";
+import { a as validateEncryptionKeyAtStartup } from "../secrets-BEgsAQEU.mjs";
 import { isRecord } from "../plugin-utils.mjs";
-import { t as resolveSessionUser } from "../session-user-BvM9-zNl.mjs";
+import { t as resolveSessionUser } from "../session-user-BEorKVT-.mjs";
 import { Kysely, sql } from "kysely";
+import { ulid } from "ulidx";
 import { z } from "zod";
 import { Permissions } from "@emdash-cms/auth";
 import { defineMiddleware } from "astro:middleware";
+import { buildTime } from "virtual:emdash/build";
 import virtualConfig from "virtual:emdash/config";
 import { createCoalescingDialect, createDialect, createRequestScopedDb } from "virtual:emdash/dialect";
 import { mediaProviders } from "virtual:emdash/media-providers";
@@ -105,9 +118,7 @@ async function repairLocaleCasing(db, configuredLocales) {
 	const tableNames = await listTablesLike(db, "ec_%");
 	for (const tableName of tableNames) {
 		const table = sql.ref(tableName);
-		const slug = tableName.slice(3);
-		for (const locale of configuredLocales) {
-			await sql`
+		for (const locale of configuredLocales) await sql`
 				UPDATE ${table} AS target
 				SET locale = ${locale}
 				WHERE lower(target.locale) = lower(${locale})
@@ -125,20 +136,1165 @@ async function repairLocaleCasing(db, configuredLocales) {
 							AND candidate.locale != ${locale}
 					)
 			`.execute(db);
-			await sql`
-				UPDATE content_taxonomies AS pivot
-				SET locale = ${locale}
-				WHERE pivot.collection = ${slug}
-					AND lower(pivot.locale) = lower(${locale})
-					AND pivot.locale != ${locale}
-					AND EXISTS (
-						SELECT 1
-						FROM ${table} AS content
-						WHERE content.id = pivot.entry_id AND content.locale = ${locale}
-					)
-			`.execute(db);
+	}
+}
+
+//#endregion
+//#region src/i18n/taxonomy-locale-diagnostic.ts
+const REPAIR_GUIDE = "https://docs.emdashcms.com/guides/internationalization/#repairing-taxonomy-locale-mismatches";
+async function warnAboutUnconfiguredTaxonomyLocales(db, configuredLocales, definitionLocales) {
+	const supportedLocales = configuredLocales.length > 0 ? configuredLocales : ["en"];
+	const definitionRows = definitionLocales === void 0 ? await db.selectFrom("_emdash_taxonomy_defs").select("locale").distinct().where("locale", "not in", supportedLocales).execute() : [...new Set(definitionLocales)].filter((locale) => !supportedLocales.includes(locale)).map((locale) => ({ locale }));
+	const termRows = await db.selectFrom("taxonomies").select("locale").distinct().where("locale", "not in", supportedLocales).execute();
+	const mismatches = [...definitionRows.map(({ locale }) => ({
+		source: "definitions",
+		locale
+	})), ...termRows.map(({ locale }) => ({
+		source: "terms",
+		locale
+	}))].toSorted((a, b) => a.source.localeCompare(b.source) || a.locale.localeCompare(b.locale));
+	if (mismatches.length === 0) return;
+	const details = mismatches.map(({ source, locale }) => `${source}: ${locale}`).join("; ");
+	console.warn(`EmDash: Taxonomy rows use locales outside the configured locales (${supportedLocales.join(", ")}): ${details}. Locale-scoped reads may not return these rows. Review and repair them explicitly: ${REPAIR_GUIDE}`);
+}
+
+//#endregion
+//#region src/media/usage/collection-deletion-processor.ts
+const MEDIA_USAGE_COLLECTION_DELETION_LIMITS = Object.freeze({
+	candidatesPerTick: 4,
+	deletionsPerTick: 1,
+	rowsPerBatch: 50,
+	leaseDurationSeconds: 300,
+	maxAttempts: 5,
+	retryBaseSeconds: 30,
+	retryMaxSeconds: 900,
+	maxQueriesPerTick: 30
+});
+async function processDueMediaUsageCollectionDeletions(db) {
+	const repository = new MediaUsageCollectionDeletionRepository(db);
+	const candidates = await repository.findDue(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.candidatesPerTick);
+	if (candidates.length === 0) return {
+		candidateCount: 0,
+		claimedCount: 0,
+		outcome: "idle"
+	};
+	let claim = null;
+	for (const candidate of candidates) {
+		claim = await repository.claim({
+			collectionId: candidate.collectionId,
+			phase: candidate.phase,
+			leaseDurationSeconds: MEDIA_USAGE_COLLECTION_DELETION_LIMITS.leaseDurationSeconds
+		});
+		if (claim?.leaseToken) break;
+	}
+	if (!claim?.leaseToken) return {
+		candidateCount: candidates.length,
+		claimedCount: 0,
+		outcome: "claim_lost"
+	};
+	try {
+		const processed = await processClaimedDeletion(db, claim);
+		if (!processed.finalized && !processed.released && !await repository.release(claim)) return {
+			candidateCount: candidates.length,
+			claimedCount: 1,
+			outcome: "claim_lost"
+		};
+		return {
+			candidateCount: candidates.length,
+			claimedCount: 1,
+			outcome: processed.finalized ? "finalized" : "progress"
+		};
+	} catch (error) {
+		const terminal = claim.attemptCount + 1 >= MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxAttempts;
+		if (!await repository.recordFailure({
+			collectionId: claim.collectionId,
+			leaseToken: claim.leaseToken,
+			errorCode: "MEDIA_USAGE_COLLECTION_DELETION_FAILED",
+			terminal,
+			retryDelaySeconds: retryDelaySeconds$2(claim.attemptCount)
+		})) return {
+			candidateCount: candidates.length,
+			claimedCount: 1,
+			outcome: "claim_lost"
+		};
+		console.error("[media-usage:collection-deletion] Processing failed:", error);
+		return {
+			candidateCount: candidates.length,
+			claimedCount: 1,
+			outcome: terminal ? "failed" : "retry"
+		};
+	}
+}
+async function processClaimedDeletion(db, claim) {
+	if (claim.phase === "fence" || claim.phase === "registry" || claim.phase === "table") {
+		await deleteActivatedMediaUsageCollection(db, {
+			collectionId: claim.collectionId,
+			collectionSlug: claim.collectionSlug,
+			forceDelete: claim.forceDelete
+		}, {
+			frontPhaseLimit: 1,
+			claimed: claim
+		});
+		return {
+			finalized: false,
+			released: true
+		};
+	}
+	if (claim.phase === "work") await processWorkBatch(db, claim);
+	if (claim.phase === "sources") await processSourceBatch(db, claim);
+	if (claim.phase === "status") await processStatus(db, claim);
+	if (claim.phase === "finalize") {
+		await finalizeDeletion(db, claim);
+		return {
+			finalized: true,
+			released: true
+		};
+	}
+	return {
+		finalized: false,
+		released: false
+	};
+}
+async function processWorkBatch(db, claim) {
+	await withTransaction(db, async (trx) => {
+		const rows = await trx.selectFrom("_emdash_media_usage_work").select("content_id").where("collection_id", "=", claim.collectionId).$if(claim.workCursor !== null, (query) => query.where("content_id", ">", claim.workCursor)).orderBy("content_id", "asc").limit(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch + 1).execute();
+		const batch = rows.slice(0, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch);
+		if (batch.length > 0) await trx.deleteFrom("_emdash_media_usage_work").where("collection_id", "=", claim.collectionId).where("content_id", "in", batch.map((row) => row.content_id)).where(liveLeaseGuard(trx, claim)).execute();
+		await updateDeletion(trx, claim, {
+			phase: rows.length > MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch ? "work" : "sources",
+			work_cursor: rows.length > MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch ? batch.at(-1).content_id : null
+		});
+	});
+	return false;
+}
+async function processSourceBatch(db, claim) {
+	await withTransaction(db, async (trx) => {
+		let sourceKey = claim.sourceKey;
+		if (!sourceKey) {
+			const source = await trx.selectFrom("_emdash_media_usage_sources").select("source_key").where("source_type", "=", "content").where("collection_id", "=", claim.collectionId).orderBy("source_key", "asc").limit(1).executeTakeFirst();
+			if (!source) {
+				await updateDeletion(trx, claim, {
+					phase: "status",
+					source_key: null,
+					occurrence_cursor: null
+				});
+				return;
+			}
+			sourceKey = source.source_key;
+			await updateDeletion(trx, claim, {
+				source_key: sourceKey,
+				occurrence_cursor: null
+			});
+		}
+		const occurrences = await trx.selectFrom("_emdash_media_usage").select("id").where("source_key", "=", sourceKey).$if(claim.occurrenceCursor !== null, (query) => query.where("id", ">", claim.occurrenceCursor)).orderBy("id", "asc").limit(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch + 1).execute();
+		const batch = occurrences.slice(0, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch);
+		if (batch.length > 0) await trx.deleteFrom("_emdash_media_usage").where("source_key", "=", sourceKey).where("id", "in", batch.map((row) => row.id)).where(liveLeaseGuard(trx, claim)).execute();
+		if (occurrences.length > MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch) {
+			await updateDeletion(trx, claim, {
+				source_key: sourceKey,
+				occurrence_cursor: batch.at(-1).id
+			});
+			return;
+		}
+		await trx.deleteFrom("_emdash_media_usage_sources").where("source_key", "=", sourceKey).where("source_type", "=", "content").where("collection_id", "=", claim.collectionId).where(liveLeaseGuard(trx, claim)).execute();
+		await updateDeletion(trx, claim, {
+			source_key: null,
+			occurrence_cursor: null
+		});
+	});
+	return false;
+}
+async function processStatus(db, claim) {
+	await withTransaction(db, async (trx) => {
+		if (await exactCleanupRowsRemain(trx, claim, false)) throw new Error("Collection deletion cleanup is incomplete");
+		await trx.deleteFrom("_emdash_media_usage_reconciliations").where("collection_id", "=", claim.collectionId).where("collection_slug", "=", claim.collectionSlug).where(liveLeaseGuard(trx, claim)).execute();
+		await trx.deleteFrom("_emdash_media_usage_index_status").where("adapter_id", "=", "content-media").where("scope_type", "=", "collection").where("scope_key", "=", claim.collectionSlug).where("collection_id", "=", claim.collectionId).where(liveLeaseGuard(trx, claim)).execute();
+		await updateDeletion(trx, claim, { phase: "finalize" });
+	});
+	return false;
+}
+async function finalizeDeletion(db, claim) {
+	if (await tableExists(db, `ec_${claim.collectionSlug}`)) throw new Error("Collection table still exists during deletion finalization");
+	if (await exactCleanupRowsRemain(db, claim)) throw new Error("Collection deletion is incomplete");
+	if (await db.selectFrom("_emdash_collections").select("id").where("id", "=", claim.collectionId).where("slug", "=", claim.collectionSlug).executeTakeFirst()) throw new Error("Collection registry identity still exists");
+	const result = await db.deleteFrom("_emdash_media_usage_collection_deletions").where("collection_id", "=", claim.collectionId).where("collection_slug", "=", claim.collectionSlug).where("state", "=", "leased").where("phase", "=", "finalize").where("lease_token", "=", claim.leaseToken).where(liveLeaseGuard(db, claim)).executeTakeFirst();
+	if (Number(result.numDeletedRows ?? 0) !== 1) throw new Error("Collection deletion lost finalization");
+	return true;
+}
+async function exactCleanupRowsRemain(db, claim, includeStatus = true) {
+	const row = (await sql`
+		SELECT
+			EXISTS (
+				SELECT 1 FROM _emdash_media_usage_work
+				WHERE collection_id = ${claim.collectionId}
+			) AS work_present,
+			EXISTS (
+				SELECT 1 FROM _emdash_media_usage_sources
+				WHERE source_type = 'content' AND collection_id = ${claim.collectionId}
+			) AS source_present,
+			EXISTS (
+				SELECT 1 FROM _emdash_media_usage_index_status
+				WHERE adapter_id = 'content-media'
+					AND scope_type = 'collection'
+					AND scope_key = ${claim.collectionSlug}
+					AND collection_id = ${claim.collectionId}
+			) AS status_present
+	`.execute(db)).rows[0];
+	return Boolean(row?.work_present) || Boolean(row?.source_present) || includeStatus && Boolean(row?.status_present);
+}
+async function updateDeletion(db, claim, values) {
+	const result = await db.updateTable("_emdash_media_usage_collection_deletions").set({
+		...values,
+		attempt_count: 0,
+		last_error_code: null,
+		updated_at: collectionDeletionCurrentTimestamp(db)
+	}).where("collection_id", "=", claim.collectionId).where("state", "=", "leased").where("lease_token", "=", claim.leaseToken).where(liveLeaseGuard(db, claim)).executeTakeFirst();
+	if (Number(result.numUpdatedRows ?? 0) !== 1) throw new Error("Collection deletion lease was lost");
+}
+function liveLeaseGuard(db, claim) {
+	return isPostgres(db) ? sql`EXISTS (
+			SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
+			WHERE deletion.collection_id = ${claim.collectionId}
+				AND deletion.state = 'leased'
+				AND deletion.lease_token = ${claim.leaseToken}
+				AND deletion.lease_expires_at::timestamptz > clock_timestamp()
+		)` : sql`EXISTS (
+			SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
+			WHERE deletion.collection_id = ${claim.collectionId}
+				AND deletion.state = 'leased'
+				AND deletion.lease_token = ${claim.leaseToken}
+				AND deletion.lease_expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+		)`;
+}
+function retryDelaySeconds$2(attemptCount) {
+	return Math.min(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.retryMaxSeconds, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.retryBaseSeconds * 2 ** attemptCount);
+}
+
+//#endregion
+//#region src/media/usage/reconciliation.ts
+const ACTIVATION_KEY = "incremental_capture";
+const CONTENT_ADAPTER_ID = "content-media";
+const COLLECTION_SCOPE = "collection";
+const MAX_CANDIDATES = 100;
+const MAX_PORTABLE_DURATION_SECONDS = 365 * 24 * 60 * 60;
+const STABLE_ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+var MediaUsageReconciliationRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	async findByIdentity(collectionId, runToken) {
+		assertIdentity({
+			collectionId,
+			runToken
+		});
+		const row = await this.db.selectFrom("_emdash_media_usage_reconciliations").selectAll().where("collection_id", "=", collectionId).where("run_token", "=", runToken).executeTakeFirst();
+		return row ? rowToRecord(row) : null;
+	}
+	async beginRun(claim) {
+		const now = timestampOffset(this.db, 0);
+		const sameRun = sql`status = 'running' AND cursor = ${claim.runToken}`;
+		return (await this.db.updateTable("_emdash_media_usage_index_status as status").set({
+			status: "running",
+			started_at: sql`CASE WHEN ${sameRun} THEN started_at ELSE ${now} END`,
+			completed_at: null,
+			cursor: claim.runToken,
+			indexed_source_count: 0,
+			failed_source_count: 0,
+			last_error_code: null,
+			change_epoch: sql`CASE WHEN ${sameRun} THEN change_epoch ELSE change_epoch + 1 END`,
+			reconciliation_required: 1,
+			updated_at: now
+		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", claim.collectionId).where("status.scope_key", "=", claim.collectionSlug).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where((eb) => eb.or([eb("status.status", "!=", "running"), eb("status.cursor", "=", claim.runToken)])).where(this.liveClaimExists(claim)).returning("change_epoch").executeTakeFirst())?.change_epoch ?? null;
+	}
+	async findScanUpperId(claim) {
+		const tableName = contentTableName(claim.collectionSlug);
+		return (await sql`
+			SELECT content.id
+			FROM ${sql.ref(tableName)} AS content
+			WHERE ${this.liveClaimExistsSql(claim)}
+			ORDER BY content.id DESC
+			LIMIT 1
+		`.execute(this.db)).rows[0]?.id ?? null;
+	}
+	async initializeScan(input) {
+		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			target_epoch: input.targetEpoch,
+			field_fingerprint: input.fieldFingerprint,
+			phase: "scan",
+			scan_cursor: null,
+			scan_upper_id: input.scanUpperId,
+			source_cursor: null,
+			source_upper_key: null,
+			attempt_count: 0,
+			last_error_code: null,
+			updated_at: timestampOffset(this.db, 0)
+		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "is", null).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch)).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async findScanPage(reconciliation, limit) {
+		if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50) throw new Error("Reconciliation scan page limit must be from 1 to 50");
+		if (!reconciliation.leaseToken || reconciliation.targetEpoch === null) return [];
+		const tableName = contentTableName(reconciliation.collectionSlug);
+		const lowerBound = reconciliation.scanCursor ? sql`AND content.id > ${reconciliation.scanCursor}` : sql``;
+		const upperBound = reconciliation.scanUpperId ? sql`AND content.id <= ${reconciliation.scanUpperId}` : sql`AND 1 = 0`;
+		return (await sql`
+			SELECT content.id
+			FROM ${sql.ref(tableName)} AS content
+			WHERE 1 = 1
+				${lowerBound}
+				${upperBound}
+				AND ${this.liveClaimExistsSql(reconciliation)}
+			ORDER BY content.id ASC
+			LIMIT ${limit}
+		`.execute(this.db)).rows.map((row) => row.id);
+	}
+	async checkpointScan(input) {
+		let query = this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			scan_cursor: input.nextCursor,
+			attempt_count: 0,
+			last_error_code: null,
+			updated_at: timestampOffset(this.db, 0)
+		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "scan").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch));
+		query = input.previousCursor ? query.where("reconciliation.scan_cursor", "=", input.previousCursor) : query.where("reconciliation.scan_cursor", "is", null);
+		const result = await query.executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async ownsRun(claim, targetEpoch) {
+		const result = await sql`
+			SELECT ${this.statusOwnsRun(claim, targetEpoch)} AS owned
+		`.execute(this.db);
+		return Boolean(result.rows[0]?.owned);
+	}
+	async restartRun(claim, previousEpoch) {
+		const now = timestampOffset(this.db, 0);
+		const interruptedRestart = sql`status = 'running'
+			AND cursor = ${claim.runToken}
+			AND change_epoch > ${previousEpoch}`;
+		return (await this.db.updateTable("_emdash_media_usage_index_status as status").set({
+			status: "running",
+			started_at: sql`CASE WHEN ${interruptedRestart} THEN started_at ELSE ${now} END`,
+			completed_at: null,
+			cursor: claim.runToken,
+			last_error_code: null,
+			change_epoch: sql`CASE WHEN ${interruptedRestart} THEN change_epoch ELSE change_epoch + 1 END`,
+			reconciliation_required: 1,
+			updated_at: now
+		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", claim.collectionId).where("status.scope_key", "=", claim.collectionSlug).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where((eb) => eb.or([eb("status.status", "!=", "running"), eb("status.cursor", "=", claim.runToken)])).where(this.liveClaimExists(claim)).returning("change_epoch").executeTakeFirst())?.change_epoch ?? null;
+	}
+	async restartScan(input) {
+		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			target_epoch: input.targetEpoch,
+			field_fingerprint: input.fieldFingerprint,
+			phase: "scan",
+			scan_cursor: null,
+			scan_upper_id: input.scanUpperId,
+			source_cursor: null,
+			source_upper_key: null,
+			attempt_count: 0,
+			next_attempt_at: timestampOffset(this.db, 0),
+			last_error_code: null,
+			updated_at: timestampOffset(this.db, 0)
+		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.previousEpoch).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch)).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async findWorkBarrier(collectionId) {
+		if (!collectionId) throw new Error("Reconciliation work barrier requires a collection ID");
+		const failed = await this.db.selectFrom("_emdash_media_usage_work").select("last_error_code").where("collection_id", "=", collectionId).where("state", "=", "failed").orderBy("content_id").limit(1).executeTakeFirst();
+		if (failed) return {
+			state: "failed",
+			errorCode: failed.last_error_code ?? "MEDIA_USAGE_PROCESSING_FAILED"
+		};
+		return await this.db.selectFrom("_emdash_media_usage_work").select("content_id").where("collection_id", "=", collectionId).limit(1).executeTakeFirst() ? { state: "pending" } : { state: "empty" };
+	}
+	async findSourceUpperKey(claim, targetEpoch) {
+		return (await this.db.selectFrom("_emdash_media_usage_sources as source").select("source.source_key").where("source.source_type", "=", "content").where("source.collection_id", "=", claim.collectionId).where("source.identity_version", "=", 1).where(this.liveClaimExists(claim)).where(this.statusOwnsRun(claim, targetEpoch)).orderBy("source.source_key", "desc").limit(1).executeTakeFirst())?.source_key ?? null;
+	}
+	async transitionToSources(input) {
+		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			phase: "sources",
+			source_cursor: null,
+			source_upper_key: input.sourceUpperKey,
+			attempt_count: 0,
+			last_error_code: null,
+			updated_at: timestampOffset(this.db, 0)
+		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.field_fingerprint", "=", input.fieldFingerprint).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "scan").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch)).where((eb) => eb.not(eb.exists(eb.selectFrom("_emdash_media_usage_work as work").select("work.content_id").where("work.collection_id", "=", input.claim.collectionId)))).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async findSourcePage(reconciliation, limit) {
+		if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50) throw new Error("Reconciliation source page limit must be from 1 to 50");
+		if (!reconciliation.leaseToken || reconciliation.targetEpoch === null) return [];
+		let query = this.db.selectFrom("_emdash_media_usage_sources as source").select([
+			"source.source_key",
+			"source.content_id",
+			"source.source_variant"
+		]).where("source.source_type", "=", "content").where("source.collection_id", "=", reconciliation.collectionId).where("source.identity_version", "=", 1).where(this.liveClaimExists(reconciliation)).where(this.statusOwnsRun(reconciliation, reconciliation.targetEpoch));
+		if (reconciliation.sourceCursor) query = query.where("source.source_key", ">", reconciliation.sourceCursor);
+		if (reconciliation.sourceUpperKey) query = query.where("source.source_key", "<=", reconciliation.sourceUpperKey);
+		else query = query.where(sql`1 = 0`);
+		return (await query.orderBy("source.source_key").limit(limit).execute()).map((row) => ({
+			sourceKey: row.source_key,
+			contentId: row.content_id,
+			sourceVariant: row.source_variant
+		}));
+	}
+	async findMissingContentIds(collectionSlug, contentIds) {
+		const unique = [...new Set(contentIds)];
+		if (unique.length === 0) return [];
+		if (unique.length > 50 || unique.some((contentId) => !contentId)) throw new Error("Reconciliation source page has invalid content identity");
+		const tableName = contentTableName(collectionSlug);
+		const existing = await sql`
+			SELECT id FROM ${sql.ref(tableName)} WHERE id IN (${sql.join(unique)})
+		`.execute(this.db);
+		const present = new Set(existing.rows.map((row) => row.id));
+		return unique.filter((contentId) => !present.has(contentId));
+	}
+	async checkpointSources(input) {
+		let query = this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			source_cursor: input.nextCursor,
+			attempt_count: 0,
+			last_error_code: null,
+			updated_at: timestampOffset(this.db, 0)
+		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "sources").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch));
+		query = input.previousCursor ? query.where("reconciliation.source_cursor", "=", input.previousCursor) : query.where("reconciliation.source_cursor", "is", null);
+		const result = await query.executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async finishFailedCoverage(collectionId, runToken) {
+		assertIdentity({
+			collectionId,
+			runToken
+		});
+		const now = timestampOffset(this.db, 0);
+		const result = await this.db.updateTable("_emdash_media_usage_index_status as status").set({
+			status: sql`CASE WHEN EXISTS (
+					SELECT 1 FROM _emdash_media_usage_sources AS source
+					WHERE source.source_type = 'content'
+						AND source.collection_id = ${collectionId}
+						AND source.identity_version = 1
+					LIMIT 1
+				) THEN 'partial' ELSE 'failed' END`,
+			completed_at: null,
+			cursor: null,
+			last_error_code: sql`CASE WHEN (
+					SELECT reconciliation.last_error_code
+					FROM _emdash_media_usage_reconciliations AS reconciliation
+					WHERE reconciliation.collection_id = ${collectionId}
+						AND reconciliation.run_token = ${runToken}
+				) = 'MEDIA_USAGE_RECONCILIATION_ENTRY_FAILED'
+				THEN COALESCE(
+					(SELECT work.last_error_code
+					 FROM _emdash_media_usage_work AS work
+					 WHERE work.collection_id = ${collectionId} AND work.state = 'failed'
+					 ORDER BY work.content_id LIMIT 1),
+					'MEDIA_USAGE_RECONCILIATION_ENTRY_FAILED'
+				)
+				ELSE (
+					SELECT reconciliation.last_error_code
+					FROM _emdash_media_usage_reconciliations AS reconciliation
+					WHERE reconciliation.collection_id = ${collectionId}
+						AND reconciliation.run_token = ${runToken}
+				) END`,
+			reconciliation_required: 1,
+			updated_at: now
+		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", collectionId).where("status.status", "=", "running").where("status.cursor", "=", runToken).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_reconciliations as reconciliation").select("reconciliation.collection_id").where("reconciliation.collection_id", "=", collectionId).where("reconciliation.run_token", "=", runToken).where("reconciliation.state", "=", "failed"))).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async finalizeCoverage(input) {
+		const now = timestampOffset(this.db, 0);
+		const result = await this.db.updateTable("_emdash_media_usage_index_status as status").set({
+			status: "complete",
+			schema_version: input.schemaVersion,
+			completed_at: now,
+			cursor: null,
+			last_error_code: null,
+			reconciliation_required: 0,
+			updated_at: now
+		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", input.claim.collectionId).where("status.scope_key", "=", input.claim.collectionSlug).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where("status.status", "=", "running").where("status.cursor", "=", input.claim.runToken).where("status.change_epoch", "=", input.targetEpoch).where((eb) => eb.not(eb.exists(eb.selectFrom("_emdash_media_usage_work as work").select("work.content_id").where("work.collection_id", "=", input.claim.collectionId)))).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_reconciliations as reconciliation").innerJoin("_emdash_collections as collection", (join) => join.onRef("collection.id", "=", "reconciliation.collection_id").onRef("collection.slug", "=", "reconciliation.collection_slug")).select("reconciliation.collection_id").where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.field_fingerprint", "=", input.fieldFingerprint).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "sources").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db, "reconciliation.lease_expires_at")).where((inner) => inner.not(inner.exists(inner.selectFrom("_emdash_media_usage_collection_deletions as deletion").select("deletion.collection_id").where("deletion.collection_id", "=", input.claim.collectionId)))))).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_activation as activation").select("activation.task_key").where("activation.task_key", "=", ACTIVATION_KEY).where("activation.state", "=", "active"))).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async deleteFinalized(claim) {
+		const result = await this.db.deleteFrom("_emdash_media_usage_reconciliations as reconciliation").where("reconciliation.collection_id", "=", claim.collectionId).where("reconciliation.run_token", "=", claim.runToken).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", claim.leaseToken).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_index_status as status").select("status.collection_id").where("status.collection_id", "=", claim.collectionId).where("status.scope_key", "=", claim.collectionSlug).where("status.status", "=", "complete").where("status.reconciliation_required", "=", 0))).executeTakeFirst();
+		return Number(result.numDeletedRows ?? 0) === 1;
+	}
+	async deleteOneObsolete() {
+		return (await sql`
+			DELETE FROM _emdash_media_usage_reconciliations
+			WHERE (collection_id, run_token) IN (
+				SELECT reconciliation.collection_id, reconciliation.run_token
+				FROM _emdash_media_usage_reconciliations AS reconciliation
+				INNER JOIN _emdash_media_usage_index_status AS status
+					ON status.collection_id = reconciliation.collection_id
+					AND status.scope_key = reconciliation.collection_slug
+				WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
+					AND status.scope_type = ${COLLECTION_SCOPE}
+					AND status.reconciliation_required = 0
+				ORDER BY reconciliation.updated_at, reconciliation.collection_id
+				LIMIT 1
+			)
+			RETURNING collection_id
+		`.execute(this.db)).rows.length === 1;
+	}
+	liveClaimExists(claim) {
+		return this.liveClaimExistsSql(claim);
+	}
+	liveClaimExistsSql(claim) {
+		return sql`EXISTS (
+			SELECT 1
+			FROM _emdash_media_usage_reconciliations AS reconciliation
+			INNER JOIN _emdash_collections AS collection
+				ON collection.id = reconciliation.collection_id
+				AND collection.slug = reconciliation.collection_slug
+			WHERE reconciliation.collection_id = ${claim.collectionId}
+				AND reconciliation.collection_slug = ${claim.collectionSlug}
+				AND reconciliation.run_token = ${claim.runToken}
+				AND reconciliation.state = 'leased'
+				AND reconciliation.lease_token = ${claim.leaseToken}
+				AND ${liveLease(this.db, "reconciliation.lease_expires_at")}
+				AND EXISTS (
+					SELECT 1 FROM _emdash_media_usage_activation AS activation
+					WHERE activation.task_key = ${ACTIVATION_KEY}
+						AND activation.state = 'active'
+				)
+				AND NOT EXISTS (
+					SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
+					WHERE deletion.collection_id = reconciliation.collection_id
+				)
+		)`;
+	}
+	statusOwnsRun(claim, targetEpoch) {
+		return sql`EXISTS (
+			SELECT 1 FROM _emdash_media_usage_index_status AS status
+			WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
+				AND status.scope_type = ${COLLECTION_SCOPE}
+				AND status.collection_id = ${claim.collectionId}
+				AND status.scope_key = ${claim.collectionSlug}
+				AND status.capture_state = 'active'
+				AND status.reconciliation_required = 1
+				AND status.status = 'running'
+				AND status.cursor = ${claim.runToken}
+				AND status.change_epoch = ${targetEpoch}
+		)`;
+	}
+	async seedNextCandidate() {
+		const runToken = ulid();
+		const now = timestampOffset(this.db, 0);
+		return (await sql`
+			INSERT INTO _emdash_media_usage_reconciliations (
+				collection_id,
+				collection_slug,
+				run_token,
+				next_attempt_at,
+				updated_at
+			)
+			SELECT status.collection_id, status.scope_key, ${runToken}, ${now}, ${now}
+			FROM _emdash_media_usage_index_status AS status
+			INNER JOIN _emdash_collections AS collection
+				ON collection.id = status.collection_id
+				AND collection.slug = status.scope_key
+			WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
+				AND status.scope_type = ${COLLECTION_SCOPE}
+				AND status.capture_state = 'active'
+				AND status.reconciliation_required = 1
+				AND status.collection_id IS NOT NULL
+				AND EXISTS (
+					SELECT 1 FROM _emdash_media_usage_activation AS activation
+					WHERE activation.task_key = ${ACTIVATION_KEY}
+						AND activation.state = 'active'
+				)
+				AND NOT EXISTS (
+					SELECT 1 FROM _emdash_media_usage_reconciliations AS existing
+					WHERE existing.collection_id = status.collection_id
+				)
+				AND NOT EXISTS (
+					SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
+					WHERE deletion.collection_id = status.collection_id
+				)
+			ORDER BY status.collection_id
+			LIMIT 1
+			ON CONFLICT (collection_id) DO NOTHING
+			RETURNING collection_id
+		`.execute(this.db)).rows.length === 1;
+	}
+	async findDue(limit) {
+		assertLimit(limit);
+		const nextAttemptIsDue = timestampIsDue(this.db, "next_attempt_at");
+		return (await sql`
+			WITH pending_candidates AS (
+				SELECT * FROM _emdash_media_usage_reconciliations
+				WHERE state = 'pending' AND ${nextAttemptIsDue}
+				ORDER BY next_attempt_at, updated_at, collection_id
+				LIMIT ${limit}
+			), retry_candidates AS (
+				SELECT * FROM _emdash_media_usage_reconciliations
+				WHERE state = 'retry' AND ${nextAttemptIsDue}
+				ORDER BY next_attempt_at, updated_at, collection_id
+				LIMIT ${limit}
+			), leased_candidates AS (
+				SELECT * FROM _emdash_media_usage_reconciliations
+				WHERE state = 'leased' AND ${timestampIsDue(this.db, "lease_expires_at")}
+				ORDER BY lease_expires_at, updated_at, collection_id
+				LIMIT ${limit}
+			), candidates AS (
+				SELECT * FROM pending_candidates
+				UNION ALL SELECT * FROM retry_candidates
+				UNION ALL SELECT * FROM leased_candidates
+			)
+			SELECT * FROM candidates
+			ORDER BY CASE WHEN state = 'leased' THEN lease_expires_at ELSE next_attempt_at END,
+				updated_at,
+				collection_id
+			LIMIT ${limit}
+		`.execute(this.db)).rows.map(rowToRecord);
+	}
+	async findFailed(limit) {
+		assertLimit(limit);
+		return (await this.db.selectFrom("_emdash_media_usage_reconciliations as reconciliation").innerJoin("_emdash_media_usage_index_status as status", (join) => join.onRef("status.collection_id", "=", "reconciliation.collection_id").onRef("status.scope_key", "=", "reconciliation.collection_slug")).selectAll("reconciliation").where("reconciliation.state", "=", "failed").where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where((eb) => eb.or([
+			eb("status.reconciliation_required", "=", 0),
+			eb.and([eb("status.status", "=", "running"), eb("status.cursor", "=", eb.ref("reconciliation.run_token"))]),
+			eb.and([eb("status.cursor", "is", null), eb("status.change_epoch", ">", eb.ref("reconciliation.target_epoch"))])
+		])).orderBy("reconciliation.updated_at").orderBy("reconciliation.collection_id").limit(limit).execute()).map(rowToRecord);
+	}
+	async claim(input) {
+		assertIdentity(input);
+		assertDuration(input.leaseDurationSeconds, "lease duration");
+		const leaseToken = ulid();
+		const row = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			state: "leased",
+			lease_token: leaseToken,
+			lease_expires_at: timestampOffset(this.db, input.leaseDurationSeconds),
+			updated_at: timestampOffset(this.db, 0)
+		}).where("reconciliation.collection_id", "=", input.collectionId).where("reconciliation.run_token", "=", input.runToken).where((eb) => eb.or([eb.and([eb("reconciliation.state", "in", ["pending", "retry"]), timestampIsDue(this.db, "reconciliation.next_attempt_at")]), eb.and([eb("reconciliation.state", "=", "leased"), timestampIsDue(this.db, "reconciliation.lease_expires_at")])])).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_activation as activation").select("activation.task_key").where("activation.task_key", "=", ACTIVATION_KEY).where("activation.state", "=", "active"))).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_index_status as status").innerJoin("_emdash_collections as collection", (join) => join.onRef("collection.id", "=", "status.collection_id").onRef("collection.slug", "=", "status.scope_key")).select("status.collection_id").whereRef("status.collection_id", "=", "reconciliation.collection_id").whereRef("status.scope_key", "=", "reconciliation.collection_slug").where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1))).where((eb) => eb.not(eb.exists(eb.selectFrom("_emdash_media_usage_collection_deletions as deletion").select("deletion.collection_id").whereRef("deletion.collection_id", "=", "reconciliation.collection_id")))).returningAll().executeTakeFirst();
+		return row ? {
+			...rowToRecord(row),
+			leaseToken
+		} : null;
+	}
+	async release(input) {
+		assertLeaseIdentity(input);
+		assertDuration(input.delaySeconds, "release delay", true);
+		const result = await this.db.updateTable("_emdash_media_usage_reconciliations").set({
+			state: "pending",
+			next_attempt_at: timestampOffset(this.db, input.delaySeconds),
+			lease_token: null,
+			lease_expires_at: null,
+			updated_at: timestampOffset(this.db, 0)
+		}).where("collection_id", "=", input.collectionId).where("run_token", "=", input.runToken).where("state", "=", "leased").where("lease_token", "=", input.leaseToken).where(liveLease(this.db)).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async recordFailure(input) {
+		assertLeaseIdentity(input);
+		if (!STABLE_ERROR_CODE_PATTERN.test(input.errorCode)) throw new Error("Reconciliation failure requires a stable error code");
+		assertDuration(input.retryDelaySeconds, "retry delay", true);
+		const result = await this.db.updateTable("_emdash_media_usage_reconciliations").set({
+			state: input.terminal ? "failed" : sql`CASE WHEN attempt_count >= 4 THEN 'failed' ELSE 'retry' END`,
+			...input.terminal ? { target_epoch: sql`COALESCE(
+								target_epoch,
+								(SELECT status.change_epoch
+								 FROM _emdash_media_usage_index_status AS status
+								 WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
+									AND status.scope_type = ${COLLECTION_SCOPE}
+									AND status.collection_id = ${input.collectionId}
+									AND status.status = 'running'
+									AND status.cursor = ${input.runToken})
+							)` } : {},
+			attempt_count: sql`attempt_count + 1`,
+			next_attempt_at: timestampOffset(this.db, input.retryDelaySeconds),
+			lease_token: null,
+			lease_expires_at: null,
+			last_error_code: input.errorCode,
+			updated_at: timestampOffset(this.db, 0)
+		}).where("collection_id", "=", input.collectionId).where("run_token", "=", input.runToken).where("state", "=", "leased").where("lease_token", "=", input.leaseToken).where(liveLease(this.db)).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async recordEntryFailure(claim) {
+		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			state: "failed",
+			attempt_count: sql`attempt_count + 1`,
+			next_attempt_at: timestampOffset(this.db, 0),
+			lease_token: null,
+			lease_expires_at: null,
+			last_error_code: "MEDIA_USAGE_RECONCILIATION_ENTRY_FAILED",
+			updated_at: timestampOffset(this.db, 0)
+		}).where("reconciliation.collection_id", "=", claim.collectionId).where("reconciliation.run_token", "=", claim.runToken).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", claim.leaseToken).where(liveLease(this.db)).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_work as work").select("work.content_id").where("work.collection_id", "=", claim.collectionId).where("work.state", "=", "failed"))).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+	async resetFailedForNewEpoch(observed) {
+		const collectionId = "collection_id" in observed ? observed.collection_id : observed.collectionId;
+		const runToken = "run_token" in observed ? observed.run_token : observed.runToken;
+		const targetEpoch = "target_epoch" in observed ? observed.target_epoch : observed.targetEpoch;
+		if (targetEpoch === null) return false;
+		const now = timestampOffset(this.db, 0);
+		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
+			state: "pending",
+			phase: "scan",
+			target_epoch: null,
+			field_fingerprint: null,
+			scan_cursor: null,
+			scan_upper_id: null,
+			source_cursor: null,
+			source_upper_key: null,
+			attempt_count: 0,
+			next_attempt_at: now,
+			lease_token: null,
+			lease_expires_at: null,
+			last_error_code: null,
+			updated_at: now
+		}).where("reconciliation.collection_id", "=", collectionId).where("reconciliation.run_token", "=", runToken).where("reconciliation.state", "=", "failed").where("reconciliation.target_epoch", "=", targetEpoch).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_index_status as status").select("status.collection_id").whereRef("status.collection_id", "=", "reconciliation.collection_id").whereRef("status.scope_key", "=", "reconciliation.collection_slug").where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where("status.cursor", "is", null).where("status.change_epoch", ">", targetEpoch))).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0) === 1;
+	}
+};
+function rowToRecord(row) {
+	if (!isState(row.state) || !isPhase(row.phase) || !Number.isSafeInteger(row.attempt_count)) throw new Error("Invalid media usage reconciliation lifecycle");
+	return {
+		collectionId: row.collection_id,
+		collectionSlug: row.collection_slug,
+		runToken: row.run_token,
+		targetEpoch: row.target_epoch,
+		fieldFingerprint: row.field_fingerprint,
+		state: row.state,
+		phase: row.phase,
+		scanCursor: row.scan_cursor,
+		scanUpperId: row.scan_upper_id,
+		sourceCursor: row.source_cursor,
+		sourceUpperKey: row.source_upper_key,
+		attemptCount: row.attempt_count,
+		nextAttemptAt: row.next_attempt_at,
+		leaseToken: row.lease_token,
+		leaseExpiresAt: row.lease_expires_at,
+		lastErrorCode: row.last_error_code,
+		createdAt: row.created_at,
+		updatedAt: row.updated_at
+	};
+}
+function isState(state) {
+	return state === "pending" || state === "retry" || state === "leased" || state === "failed";
+}
+function isPhase(phase) {
+	return phase === "scan" || phase === "sources";
+}
+function assertLimit(limit) {
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_CANDIDATES) throw new Error("Reconciliation candidate limit must be from 1 to 100");
+}
+function assertIdentity(input) {
+	if (!input.collectionId || !input.runToken) throw new Error("Reconciliation requires an exact collection and run token");
+}
+function assertLeaseIdentity(input) {
+	assertIdentity(input);
+	if (!input.leaseToken) throw new Error("Reconciliation requires a lease token");
+}
+function assertDuration(value, label, allowZero = false) {
+	if (!Number.isSafeInteger(value) || value < (allowZero ? 0 : 1) || value > MAX_PORTABLE_DURATION_SECONDS) throw new Error(`Reconciliation ${label} is outside the portable range`);
+}
+function liveLease(db, column = "lease_expires_at") {
+	const expiry = sql.ref(column);
+	return isPostgres(db) ? sql`${expiry} > to_char(statement_timestamp() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')` : sql`${expiry} > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
+}
+function timestampIsDue(db, column) {
+	const value = sql.ref(column);
+	return isPostgres(db) ? sql`${value} <= to_char(statement_timestamp() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')` : sql`${value} <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
+}
+function timestampOffset(db, offsetSeconds) {
+	if (isPostgres(db)) return sql`to_char(
+			(clock_timestamp() AT TIME ZONE 'UTC') + (${offsetSeconds} * INTERVAL '1 second'),
+			'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
+		)`;
+	return sql`strftime(
+		'%Y-%m-%dT%H:%M:%fZ',
+		'now',
+		${`${offsetSeconds >= 0 ? "+" : ""}${offsetSeconds} seconds`}
+	)`;
+}
+function contentTableName(collectionSlug) {
+	validateIdentifier(collectionSlug, "collection slug");
+	const tableName = `ec_${collectionSlug}`;
+	validateIdentifier(tableName, "content table");
+	return tableName;
+}
+
+//#endregion
+//#region src/media/usage/reconciliation-processor.ts
+const MEDIA_USAGE_RECONCILIATION_LIMITS = Object.freeze({
+	candidatesPerTick: 4,
+	pageSize: 50,
+	leaseDurationSeconds: 60,
+	maxAttempts: 5,
+	retryBaseSeconds: 30,
+	retryMaxSeconds: 900,
+	retryJitterRatio: .25,
+	maxQueriesPerTick: 20
+});
+async function processDueMediaUsageReconciliation(db) {
+	if ((await db.selectFrom("_emdash_media_usage_activation").select("state").where("task_key", "=", "incremental_capture").executeTakeFirst())?.state !== "active") return "inactive";
+	const reconciliation = new MediaUsageReconciliationRepository(db);
+	if (await reconciliation.deleteOneObsolete()) return "completed";
+	const [failed] = await reconciliation.findFailed(1);
+	if (failed) {
+		if (await reconciliation.finishFailedCoverage(failed.collectionId, failed.runToken)) return "failed";
+		if (await reconciliation.resetFailedForNewEpoch(failed)) return "advanced";
+	}
+	await reconciliation.seedNextCandidate();
+	const candidates = await reconciliation.findDue(MEDIA_USAGE_RECONCILIATION_LIMITS.candidatesPerTick);
+	let claim = null;
+	for (const candidate of candidates) {
+		claim = await reconciliation.claim({
+			collectionId: candidate.collectionId,
+			runToken: candidate.runToken,
+			leaseDurationSeconds: MEDIA_USAGE_RECONCILIATION_LIMITS.leaseDurationSeconds
+		});
+		if (claim) break;
+	}
+	if (!claim) return candidates.length === 0 ? "not_due" : "claim_lost";
+	try {
+		return await processClaimedReconciliation(db, claim);
+	} catch (error) {
+		const terminal = claim.attemptCount + 1 >= MEDIA_USAGE_RECONCILIATION_LIMITS.maxAttempts;
+		if (!await reconciliation.recordFailure({
+			collectionId: claim.collectionId,
+			runToken: claim.runToken,
+			leaseToken: claim.leaseToken,
+			errorCode: "MEDIA_USAGE_RECONCILIATION_FAILED",
+			retryDelaySeconds: retryDelaySeconds$1(claim.attemptCount),
+			terminal
+		})) return "claim_lost";
+		if (terminal) await reconciliation.finishFailedCoverage(claim.collectionId, claim.runToken);
+		console.error("[media-usage:reconciliation] Processing failed:", error);
+		return terminal ? "failed" : "retry";
+	}
+}
+async function processClaimedMediaUsageReconciliationScan(db, claim, options = {}) {
+	const reconciliation = new MediaUsageReconciliationRepository(db);
+	let current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken);
+	if (!current || current.leaseToken !== claim.leaseToken || current.phase !== "scan") return "deferred";
+	let fields;
+	let fieldFingerprint;
+	if (current.targetEpoch === null) {
+		const targetEpoch = await reconciliation.beginRun(claim);
+		if (targetEpoch === null) {
+			await reconciliation.release({
+				...claim,
+				delaySeconds: 30
+			});
+			return "deferred";
+		}
+		fields = await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
+		fieldFingerprint = await buildContentMediaUsageFieldFingerprint(fields);
+		const scanUpperId = fields.extractionFields.length === 0 ? null : await reconciliation.findScanUpperId(claim);
+		if (!await reconciliation.initializeScan({
+			claim,
+			targetEpoch,
+			fieldFingerprint,
+			scanUpperId
+		})) return "deferred";
+		current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken);
+		if (!current) return "deferred";
+	} else {
+		fields = await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
+		fieldFingerprint = await buildContentMediaUsageFieldFingerprint(fields);
+	}
+	if (current.fieldFingerprint !== fieldFingerprint || current.targetEpoch === null) return "restart_required";
+	const contentIds = await reconciliation.findScanPage(current, 50);
+	if (contentIds.length === 0) {
+		if (options.releaseOnExhausted ?? true) await reconciliation.release({
+			...claim,
+			delaySeconds: 30
+		});
+		return "exhausted";
+	}
+	await new MediaUsageWorkRepository(db).enqueueReconciliationPage({
+		collectionId: claim.collectionId,
+		collectionSlug: claim.collectionSlug,
+		runToken: claim.runToken,
+		leaseToken: claim.leaseToken,
+		changeEpoch: current.targetEpoch,
+		phase: "scan",
+		contentIds
+	});
+	const nextCursor = contentIds.at(-1);
+	if (!await reconciliation.checkpointScan({
+		claim,
+		targetEpoch: current.targetEpoch,
+		previousCursor: current.scanCursor,
+		nextCursor
+	})) return "deferred";
+	if (!await reconciliation.release({
+		...claim,
+		delaySeconds: 0
+	})) return "deferred";
+	return "advanced";
+}
+async function processClaimedReconciliation(db, claim) {
+	const reconciliation = new MediaUsageReconciliationRepository(db);
+	let current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken);
+	if (!current || current.leaseToken !== claim.leaseToken) return "claim_lost";
+	if (current.targetEpoch !== null && !await reconciliation.ownsRun(claim, current.targetEpoch)) return restartReconciliation(db, reconciliation, claim, current);
+	if (current.phase === "scan") {
+		const outcome = await processClaimedMediaUsageReconciliationScan(db, claim, { releaseOnExhausted: false });
+		if (outcome === "restart_required") {
+			current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken) ?? current;
+			return restartReconciliation(db, reconciliation, claim, current);
+		}
+		if (outcome !== "exhausted") return outcome;
+		current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken) ?? current;
+		const barrier = await reconciliation.findWorkBarrier(claim.collectionId);
+		if (barrier.state === "failed") return failReconciliation(reconciliation, claim, barrier.errorCode, true);
+		if (barrier.state === "pending") {
+			await reconciliation.release({
+				...claim,
+				delaySeconds: 30
+			});
+			return "deferred";
+		}
+		if (current.targetEpoch === null || current.fieldFingerprint === null) return "claim_lost";
+		const sourceUpperKey = await reconciliation.findSourceUpperKey(claim, current.targetEpoch);
+		if (!await reconciliation.transitionToSources({
+			claim,
+			targetEpoch: current.targetEpoch,
+			fieldFingerprint: current.fieldFingerprint,
+			sourceUpperKey
+		})) return "claim_lost";
+		if (!await reconciliation.release({
+			...claim,
+			delaySeconds: 0
+		})) return "claim_lost";
+		return "advanced";
+	}
+	return processSourcePhase(db, reconciliation, claim, current);
+}
+async function processSourcePhase(db, reconciliation, claim, current) {
+	if (current.targetEpoch === null || current.fieldFingerprint === null) return "claim_lost";
+	const fields = await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
+	const fieldFingerprint = await buildContentMediaUsageFieldFingerprint(fields);
+	if (fieldFingerprint !== current.fieldFingerprint) return restartReconciliation(db, reconciliation, claim, current, fields, fieldFingerprint);
+	const page = await reconciliation.findSourcePage(current, MEDIA_USAGE_RECONCILIATION_LIMITS.pageSize);
+	if (page.length > 0) {
+		if (page.some((source) => !source.contentId || source.sourceVariant !== "columns" && source.sourceVariant !== "draft_overlay")) return failReconciliation(reconciliation, claim, "MEDIA_USAGE_RECONCILIATION_INVALID_SOURCE", false);
+		const contentIds = [...new Set(page.map((source) => source.contentId))];
+		const enqueueIds = fields.extractionFields.length === 0 ? contentIds : await reconciliation.findMissingContentIds(claim.collectionSlug, contentIds);
+		if (enqueueIds.length > 0) await new MediaUsageWorkRepository(db).enqueueReconciliationPage({
+			collectionId: claim.collectionId,
+			collectionSlug: claim.collectionSlug,
+			runToken: claim.runToken,
+			leaseToken: claim.leaseToken,
+			changeEpoch: current.targetEpoch,
+			phase: "sources",
+			contentIds: enqueueIds
+		});
+		if (!await reconciliation.checkpointSources({
+			claim,
+			targetEpoch: current.targetEpoch,
+			previousCursor: current.sourceCursor,
+			nextCursor: page.at(-1).sourceKey
+		})) return "claim_lost";
+		if (!await reconciliation.release({
+			...claim,
+			delaySeconds: 0
+		})) return "claim_lost";
+		return "advanced";
+	}
+	const barrier = await reconciliation.findWorkBarrier(claim.collectionId);
+	if (barrier.state === "failed") return failReconciliation(reconciliation, claim, barrier.errorCode, true);
+	if (barrier.state === "pending") {
+		await reconciliation.release({
+			...claim,
+			delaySeconds: 30
+		});
+		return "deferred";
+	}
+	if (!await reconciliation.finalizeCoverage({
+		claim,
+		targetEpoch: current.targetEpoch,
+		fieldFingerprint,
+		schemaVersion: CONTENT_SOURCE_SCHEMA_VERSION
+	})) return "claim_lost";
+	if (!await reconciliation.deleteFinalized(claim)) return "claim_lost";
+	return "completed";
+}
+async function restartReconciliation(db, reconciliation, claim, current, fields, fieldFingerprint) {
+	if (current.targetEpoch === null) return "claim_lost";
+	const discoveredFields = fields ?? await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
+	const fingerprint = fieldFingerprint ?? await buildContentMediaUsageFieldFingerprint(discoveredFields);
+	const targetEpoch = await reconciliation.restartRun(claim, current.targetEpoch);
+	if (targetEpoch === null) {
+		await reconciliation.release({
+			...claim,
+			delaySeconds: 30
+		});
+		return "deferred";
+	}
+	const scanUpperId = discoveredFields.extractionFields.length === 0 ? null : await reconciliation.findScanUpperId(claim);
+	if (!await reconciliation.restartScan({
+		claim,
+		previousEpoch: current.targetEpoch,
+		targetEpoch,
+		fieldFingerprint: fingerprint,
+		scanUpperId
+	})) return "claim_lost";
+	if (!await reconciliation.release({
+		...claim,
+		delaySeconds: 0
+	})) return "claim_lost";
+	return "advanced";
+}
+async function failReconciliation(reconciliation, claim, errorCode, entryFailure) {
+	if (!(entryFailure ? await reconciliation.recordEntryFailure(claim) : await reconciliation.recordFailure({
+		collectionId: claim.collectionId,
+		runToken: claim.runToken,
+		leaseToken: claim.leaseToken,
+		errorCode,
+		retryDelaySeconds: 0,
+		terminal: true
+	}))) return "claim_lost";
+	await reconciliation.finishFailedCoverage(claim.collectionId, claim.runToken);
+	return "failed";
+}
+function retryDelaySeconds$1(attemptCount) {
+	const exponential = Math.min(MEDIA_USAGE_RECONCILIATION_LIMITS.retryMaxSeconds, MEDIA_USAGE_RECONCILIATION_LIMITS.retryBaseSeconds * 2 ** attemptCount);
+	const jitter = Math.floor(exponential * MEDIA_USAGE_RECONCILIATION_LIMITS.retryJitterRatio * Math.random());
+	return Math.min(MEDIA_USAGE_RECONCILIATION_LIMITS.retryMaxSeconds, exponential + jitter);
+}
+
+//#endregion
+//#region src/media/usage/work-processor.ts
+const MEDIA_USAGE_WORK_PROCESSING_LIMITS = Object.freeze({
+	candidatesPerTick: 4,
+	jobsPerTick: 1,
+	maxTickDurationMs: 5e3,
+	leaseDurationSeconds: 60,
+	maxAttempts: 5,
+	retryBaseSeconds: 30,
+	retryMaxSeconds: 900,
+	retryJitterRatio: .25,
+	ordinaryStatementsPerJob: 20
+});
+async function processMediaUsageWorkAfterWrite(db, collectionSlug, contentId) {
+	if (!await isIncrementalCaptureActive(db)) return {
+		outcome: "inactive",
+		claimed: false
+	};
+	const repo = new MediaUsageWorkRepository(db);
+	const work = await repo.findWorkForContent(collectionSlug, contentId);
+	if (!work) return {
+		outcome: "not_due",
+		claimed: false
+	};
+	return processCandidate(db, repo, work);
+}
+async function processDueMediaUsageWork(db) {
+	const startedAt = Date.now();
+	const result = {
+		candidateCount: 0,
+		claimedCount: 0,
+		completedCount: 0,
+		retryCount: 0,
+		failedCount: 0,
+		supersededCount: 0,
+		obsoleteCount: 0,
+		durationMs: 0,
+		admissionClosed: false
+	};
+	if (!await isIncrementalCaptureActive(db)) {
+		result.durationMs = Date.now() - startedAt;
+		return result;
+	}
+	const repo = new MediaUsageWorkRepository(db);
+	const candidates = await repo.findDueWork(MEDIA_USAGE_WORK_PROCESSING_LIMITS.candidatesPerTick);
+	result.candidateCount = candidates.length;
+	for (const candidate of candidates) {
+		if (result.claimedCount >= MEDIA_USAGE_WORK_PROCESSING_LIMITS.jobsPerTick || Date.now() - startedAt >= MEDIA_USAGE_WORK_PROCESSING_LIMITS.maxTickDurationMs) {
+			result.admissionClosed = true;
+			break;
 		}
+		const processed = await processCandidate(db, repo, candidate);
+		if (processed.claimed) result.claimedCount++;
+		if (processed.outcome === "completed") result.completedCount++;
+		if (processed.outcome === "retry") result.retryCount++;
+		if (processed.outcome === "failed") result.failedCount++;
+		if (processed.outcome === "superseded") result.supersededCount++;
+		if (processed.outcome === "obsolete") result.obsoleteCount++;
 	}
+	result.durationMs = Date.now() - startedAt;
+	return result;
+}
+async function processCandidate(db, repo, candidate) {
+	const claimed = await repo.claimWork({
+		collectionId: candidate.collectionId,
+		contentId: candidate.contentId,
+		workVersion: candidate.workVersion,
+		leaseDurationSeconds: MEDIA_USAGE_WORK_PROCESSING_LIMITS.leaseDurationSeconds
+	});
+	if (!claimed?.leaseToken) return {
+		outcome: "claim_lost",
+		claimed: false
+	};
+	const lease = {
+		collectionId: claimed.collectionId,
+		contentId: claimed.contentId,
+		workVersion: claimed.workVersion,
+		leaseToken: claimed.leaseToken
+	};
+	if (!await collectionIdentityIsCurrent(db, claimed.collectionId, claimed.collectionSlug)) return {
+		outcome: await repo.completeWork(lease) ? "obsolete" : "superseded",
+		claimed: true
+	};
+	const refresh = await refreshContentMediaUsageForWork(db, claimed.collectionId, claimed.collectionSlug, claimed.contentId);
+	if (refresh.success) {
+		const completed = await repo.completeWork(lease);
+		if (completed) await new MediaUsageRepository(db).recordIncrementalSuccess({
+			collectionId: claimed.collectionId,
+			collectionSlug: claimed.collectionSlug
+		});
+		return {
+			outcome: completed ? "completed" : "superseded",
+			claimed: true
+		};
+	}
+	if (!await collectionIdentityIsCurrent(db, claimed.collectionId, claimed.collectionSlug)) return {
+		outcome: await repo.completeWork(lease) ? "obsolete" : "superseded",
+		claimed: true
+	};
+	const errorCode = processingErrorCode(refresh.errorCode);
+	if (errorCode === "MEDIA_USAGE_RESOURCE_LIMIT" || claimed.attemptCount + 1 >= MEDIA_USAGE_WORK_PROCESSING_LIMITS.maxAttempts) {
+		const failed = await repo.failWork({
+			...lease,
+			errorCode
+		});
+		if (failed) await new MediaUsageRepository(db).recordIncrementalFailure({
+			collectionId: claimed.collectionId,
+			collectionSlug: claimed.collectionSlug,
+			contentId: claimed.contentId,
+			workVersion: claimed.workVersion,
+			errorCode
+		});
+		return {
+			outcome: failed ? "failed" : "superseded",
+			claimed: true
+		};
+	}
+	return {
+		outcome: await repo.retryWork({
+			...lease,
+			errorCode,
+			retryDelaySeconds: retryDelaySeconds(claimed.attemptCount)
+		}) ? "retry" : "superseded",
+		claimed: true
+	};
+}
+async function isIncrementalCaptureActive(db) {
+	return (await db.selectFrom("_emdash_media_usage_activation").select("state").where("task_key", "=", "incremental_capture").executeTakeFirst())?.state === "active";
+}
+async function collectionIdentityIsCurrent(db, collectionId, collectionSlug) {
+	return await db.selectFrom("_emdash_collections").select("id").where("id", "=", collectionId).where("slug", "=", collectionSlug).executeTakeFirst() !== void 0;
+}
+function retryDelaySeconds(attemptCount) {
+	const exponential = Math.min(MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryMaxSeconds, MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryBaseSeconds * 2 ** attemptCount);
+	const jitter = Math.floor(exponential * MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryJitterRatio * Math.random());
+	return Math.min(MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryMaxSeconds, exponential + jitter);
+}
+function processingErrorCode(errorCode) {
+	if (errorCode === "DRAFT_REVISION_NOT_FOUND" || errorCode === "DRAFT_REVISION_MISMATCH" || errorCode === "DRAFT_REVISION_INVALID") return "MEDIA_USAGE_SNAPSHOT_FAILED";
+	if (errorCode === "CONTENT_USAGE_GENERATION_CONFLICT") return "MEDIA_USAGE_GENERATION_CONFLICT";
+	if (errorCode === "CONTENT_USAGE_RESOURCE_LIMIT") return "MEDIA_USAGE_RESOURCE_LIMIT";
+	return "MEDIA_USAGE_PROCESSING_FAILED";
 }
 
 //#endregion
@@ -155,32 +1311,225 @@ function createSandboxRunnerOptions(options, siteInfo) {
 }
 
 //#endregion
-//#region src/media/usage/gc.ts
-/**
-* Only rows older than this are collected. Guarded writers insert occurrence
-* rows before winning the source CAS, so the window must exceed any plausible
-* in-flight write; mirrors the pending-upload abandonment window.
-*/
-const GC_MAX_AGE_MS = 3600 * 1e3;
+//#region src/media/usage/cleanup.ts
+const MEDIA_USAGE_CLEANUP_CANDIDATE_LIMIT = 250;
+const MEDIA_USAGE_CLEANUP_DELETE_LIMIT = 50;
+const MEDIA_USAGE_CLEANUP_WRITE_LEASE_DELETE_LIMIT = 49;
+const MEDIA_USAGE_CLEANUP_INTERVAL_MS = 60 * 1e3;
+const MEDIA_USAGE_CLEANUP_LEASE_MS = 300 * 1e3;
+const MEDIA_USAGE_CLEANUP_SAFETY_WINDOW_MS = 3600 * 1e3;
+const MEDIA_USAGE_CLEANUP_TIME_BUDGET_MS = 5 * 1e3;
 /**
-* Per-tick cap on rows considered by each GC method, so a large backlog is
-* amortized across ticks instead of one oversized batch (D1 bind limits).
-*/
-const GC_BATCH_LIMIT = 500;
-/**
-* Delete media-usage occurrence rows that can no longer be read: superseded
-* generations, generations abandoned by losing CAS writers, and occurrences
-* whose source row is gone.
+* Reclaims a bounded window of obsolete media-usage occurrences.
+*
+* The persisted claim makes a cron tick single-flight across Worker isolates
+* and Node processes.
 */
-async function cleanupMediaUsageGenerations(db) {
-	const cutoff = new Date(Date.now() - GC_MAX_AGE_MS).toISOString();
+async function cleanupMediaUsage(db) {
+	const startedMs = Date.now();
+	const canIssueStatement = () => withinBudget(startedMs);
 	const repo = new MediaUsageRepository(db);
+	const leaseToken = ulid();
+	const claim = await repo.claimMediaUsageCleanup({
+		leaseToken,
+		leaseDurationSeconds: MEDIA_USAGE_CLEANUP_LEASE_MS / 1e3,
+		nextEligibleDelaySeconds: MEDIA_USAGE_CLEANUP_INTERVAL_MS / 1e3,
+		sweepSafetyWindowSeconds: MEDIA_USAGE_CLEANUP_SAFETY_WINDOW_MS / 1e3
+	});
+	if (!claim) return emptyResult("skipped", elapsedSince(startedMs));
+	let candidateRows = 0;
+	let deletedOrphans = 0;
+	let deletedStale = 0;
+	let deletedAbandoned = 0;
+	let deletedWriteLeases = 0;
+	let backlogLowerBound = 0;
+	let scanHasMore = false;
+	let nextCursor = claim.cursor;
+	let sweepComplete = false;
+	try {
+		if (canIssueStatement()) deletedWriteLeases = await repo.deleteExpiredGenerationWriteLeases(MEDIA_USAGE_CLEANUP_WRITE_LEASE_DELETE_LIMIT, cleanupLease(leaseToken), canIssueStatement);
+		if (canIssueStatement()) {
+			const cutoff = claim.scanBeforeAt;
+			const candidates = await repo.findMediaUsageCleanupCandidates({
+				cutoff,
+				cursor: claim.cursor,
+				limit: MEDIA_USAGE_CLEANUP_CANDIDATE_LIMIT,
+				cleanupLease: cleanupLease(leaseToken)
+			});
+			candidateRows = candidates.length;
+			scanHasMore = candidates.length === MEDIA_USAGE_CLEANUP_CANDIDATE_LIMIT;
+			const selected = selectCleanupCandidates(candidates, claim.claimedAt);
+			backlogLowerBound = selected.orphanIds.length + selected.staleIds.length + selected.abandonedIds.length;
+			const completedTargets = /* @__PURE__ */ new Set();
+			let canContinue = true;
+			if (canIssueStatement() && selected.orphanIds.length > 0) {
+				deletedOrphans = await repo.deleteOrphanOccurrencesOlderThan(cutoff, selected.orphanIds.length, {
+					candidateIds: selected.orphanIds,
+					cleanupLease: cleanupLease(leaseToken),
+					canIssueStatement
+				});
+				canContinue = deletedOrphans === selected.orphanIds.length;
+				if (canContinue) completedTargets.add("orphan");
+			}
+			if (canContinue && canIssueStatement() && selected.staleIds.length > 0) {
+				deletedStale = await repo.deleteStaleGenerationsOlderThan(cutoff, selected.staleIds.length, {
+					candidateIds: selected.staleIds,
+					cleanupLease: cleanupLease(leaseToken),
+					canIssueStatement
+				});
+				canContinue = deletedStale === selected.staleIds.length;
+				if (canContinue) completedTargets.add("stale");
+			}
+			if (canContinue && canIssueStatement() && selected.abandonedIds.length > 0) {
+				deletedAbandoned = await repo.deleteAbandonedGenerationsOlderThan(cutoff, selected.abandonedIds.length, {
+					candidateIds: selected.abandonedIds,
+					cleanupLease: cleanupLease(leaseToken),
+					canIssueStatement
+				});
+				if (deletedAbandoned === selected.abandonedIds.length) completedTargets.add("abandoned");
+			}
+			const hasIncompleteTargets = selected.entries.some((entry) => entry.target !== null && !completedTargets.has(entry.target));
+			sweepComplete = !scanHasMore && selected.entries.length === candidates.length && !hasIncompleteTargets;
+			nextCursor = sweepComplete ? null : cursorAfterCompletedCandidates(selected, completedTargets, claim.cursor);
+		}
+		const durationMs = elapsedSince(startedMs);
+		return {
+			status: await repo.completeMediaUsageCleanup({
+				leaseToken,
+				nextCursor,
+				sweepComplete,
+				candidateCount: candidateRows,
+				deletedOrphans,
+				deletedStale,
+				deletedAbandoned,
+				deletedWriteLeases,
+				backlogLowerBound,
+				scanHasMore,
+				durationMs
+			}) ? "completed" : "skipped",
+			candidateRows,
+			deletedRows: deletedOrphans + deletedStale + deletedAbandoned,
+			deletedOrphans,
+			deletedStale,
+			deletedAbandoned,
+			deletedWriteLeases,
+			backlogLowerBound,
+			scanHasMore,
+			durationMs
+		};
+	} catch (error) {
+		const durationMs = elapsedSince(startedMs);
+		const failures = Math.min(claim.consecutiveFailures + 1, 5);
+		try {
+			await repo.failMediaUsageCleanup({
+				leaseToken,
+				retryDelaySeconds: failureDelayMs(failures) / 1e3,
+				consecutiveFailures: failures,
+				durationMs,
+				errorCode: "MEDIA_USAGE_CLEANUP_FAILED"
+			});
+		} catch (failureError) {
+			console.error("[media-usage-cleanup] Failed to record cleanup failure:", failureError);
+		}
+		console.error("[media-usage-cleanup] Cleanup failed:", error);
+		return {
+			...emptyResult("failed", durationMs),
+			candidateRows,
+			deletedRows: deletedOrphans + deletedStale + deletedAbandoned,
+			deletedOrphans,
+			deletedStale,
+			deletedAbandoned,
+			deletedWriteLeases,
+			backlogLowerBound,
+			scanHasMore
+		};
+	}
+}
+function selectCleanupCandidates(candidates, activeLeaseAt) {
+	const orphanIds = [];
+	const staleIds = [];
+	const abandonedIds = [];
+	const entries = [];
+	for (const candidate of candidates) {
+		if (hasActiveWriteLease(candidate, activeLeaseAt)) {
+			entries.push({
+				candidate,
+				target: null
+			});
+			continue;
+		}
+		const target = cleanupTarget(candidate);
+		if (target === null) {
+			entries.push({
+				candidate,
+				target: null
+			});
+			continue;
+		}
+		if (orphanIds.length + staleIds.length + abandonedIds.length >= MEDIA_USAGE_CLEANUP_DELETE_LIMIT) break;
+		if (target === "orphan") orphanIds.push(candidate.id);
+		if (target === "stale") staleIds.push(candidate.id);
+		if (target === "abandoned") abandonedIds.push(candidate.id);
+		entries.push({
+			candidate,
+			target
+		});
+	}
 	return {
-		staleGenerations: await repo.deleteStaleGenerationsOlderThan(cutoff, GC_BATCH_LIMIT),
-		abandonedGenerations: await repo.deleteAbandonedGenerationsOlderThan(cutoff, GC_BATCH_LIMIT),
-		orphanOccurrences: await repo.deleteOrphanOccurrencesOlderThan(cutoff, GC_BATCH_LIMIT)
+		orphanIds,
+		staleIds,
+		abandonedIds,
+		entries
 	};
 }
+function cleanupTarget(candidate) {
+	if (candidate.currentGeneration === null) return "orphan";
+	if (candidate.currentGeneration === candidate.generation || candidate.indexedAt === null) return null;
+	return candidate.createdAt < candidate.indexedAt ? "stale" : "abandoned";
+}
+function hasActiveWriteLease(candidate, activeLeaseAt) {
+	return candidate.writeLeaseExpiresAt !== null && candidate.writeLeaseExpiresAt > activeLeaseAt;
+}
+function cursorFor(candidate) {
+	return {
+		createdAt: candidate.createdAt,
+		id: candidate.id
+	};
+}
+function cursorAfterCompletedCandidates(selected, completedTargets, priorCursor) {
+	let cursor = priorCursor;
+	for (const entry of selected.entries) {
+		if (entry.target !== null && !completedTargets.has(entry.target)) break;
+		cursor = cursorFor(entry.candidate);
+	}
+	return cursor;
+}
+function emptyResult(status, durationMs) {
+	return {
+		status,
+		candidateRows: 0,
+		deletedRows: 0,
+		deletedOrphans: 0,
+		deletedStale: 0,
+		deletedAbandoned: 0,
+		deletedWriteLeases: 0,
+		backlogLowerBound: 0,
+		scanHasMore: false,
+		durationMs
+	};
+}
+function withinBudget(startedMs) {
+	return elapsedSince(startedMs) < MEDIA_USAGE_CLEANUP_TIME_BUDGET_MS;
+}
+function elapsedSince(startedMs) {
+	return Math.max(0, Date.now() - startedMs);
+}
+function failureDelayMs(consecutiveFailures) {
+	return Math.min(2 ** (consecutiveFailures - 1), 15) * MEDIA_USAGE_CLEANUP_INTERVAL_MS;
+}
+function cleanupLease(leaseToken) {
+	return { leaseToken };
+}
 
 //#endregion
 //#region src/cleanup.ts
@@ -215,9 +1564,7 @@ async function runSystemCleanup(db, storage) {
 		pendingUploadFiles: -1,
 		uploadAttempts: -1,
 		revisionsPruned: -1,
-		mediaUsageStaleGenerations: -1,
-		mediaUsageAbandonedGenerations: -1,
-		mediaUsageOrphanOccurrences: -1
+		mediaUsage: -1
 	};
 	try {
 		result.challenges = await cleanupExpiredChallenges(db);
@@ -265,12 +1612,10 @@ async function runSystemCleanup(db, storage) {
 		console.error("[cleanup] Failed to prune revisions:", error);
 	}
 	try {
-		const usage = await cleanupMediaUsageGenerations(db);
-		result.mediaUsageStaleGenerations = usage.staleGenerations;
-		result.mediaUsageAbandonedGenerations = usage.abandonedGenerations;
-		result.mediaUsageOrphanOccurrences = usage.orphanOccurrences;
+		const mediaUsage = await cleanupMediaUsage(db);
+		result.mediaUsage = mediaUsage.status === "failed" ? -1 : mediaUsage.deletedRows;
 	} catch (error) {
-		console.error("[cleanup] Failed to clean media-usage generations:", error);
+		console.error("[cleanup] Failed to clean media usage:", error);
 	}
 	return result;
 }
@@ -469,6 +1814,15 @@ const DRAFT_ONLY_UPDATE_KEYS = new Set([
 	"skipRevision"
 ]);
 const MAX_DRAFT_STAGE_ATTEMPTS = 32;
+const LIST_COLUMN_FIELD_TYPES = new Set([
+	"string",
+	"number",
+	"integer",
+	"boolean",
+	"datetime",
+	"select",
+	"multiSelect"
+]);
 /**
 * Convert a ContentItem to Record<string, unknown> for hook consumption.
 * Hooks receive the full item as a flat record.
@@ -552,6 +1906,49 @@ const marketplaceManifestCache = /* @__PURE__ */ new Map();
 /** Route metadata for sandboxed plugins: pluginId -> routeName -> RouteMeta */
 const sandboxedRouteMetaCache = /* @__PURE__ */ new Map();
 let sandboxRunner = null;
+const MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS = Object.freeze({
+	entryWork: MEDIA_USAGE_WORK_PROCESSING_LIMITS.ordinaryStatementsPerJob,
+	collectionDeletion: MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxQueriesPerTick,
+	reconciliation: MEDIA_USAGE_RECONCILIATION_LIMITS.maxQueriesPerTick,
+	maxClassQueries: Math.max(MEDIA_USAGE_WORK_PROCESSING_LIMITS.ordinaryStatementsPerJob, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxQueriesPerTick, MEDIA_USAGE_RECONCILIATION_LIMITS.maxQueriesPerTick),
+	eventCeiling: 40
+});
+async function runScheduledMediaUsageLane(db) {
+	if ((getRequestContext()?.metrics?.dbCount ?? 0) + 1 + MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS.maxClassQueries > MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS.eventCeiling) return {
+		outcome: "admission_closed",
+		taskClass: null,
+		turn: null
+	};
+	const activation = await db.updateTable("_emdash_media_usage_activation").set({ media_usage_maintenance_turn: sql`(media_usage_maintenance_turn + 1) % 3` }).where("task_key", "=", "incremental_capture").where("state", "=", "active").returning("media_usage_maintenance_turn").executeTakeFirst();
+	if (!activation) return {
+		outcome: "inactive",
+		taskClass: null,
+		turn: null
+	};
+	const turn = activation.media_usage_maintenance_turn;
+	if (turn === 0) {
+		await processDueMediaUsageWork(db);
+		return {
+			outcome: "processed",
+			taskClass: "entry_work",
+			turn
+		};
+	}
+	if (turn === 1) {
+		await processDueMediaUsageCollectionDeletions(db);
+		return {
+			outcome: "processed",
+			taskClass: "collection_deletion",
+			turn
+		};
+	}
+	await processDueMediaUsageReconciliation(db);
+	return {
+		outcome: "processed",
+		taskClass: "reconciliation",
+		turn
+	};
+}
 /**
 * EmDashRuntime - singleton per worker
 */
@@ -663,7 +2060,14 @@ var EmDashRuntime = class EmDashRuntime {
 	* Returns the items promoted so callers can invalidate their cache tags.
 	*/
 	async publishScheduled() {
-		return publishDueContent(this.db, { publish: (collection, id, options) => this.handleContentPublish(collection, id, options) });
+		return this.publishScheduledWithFence();
+	}
+	async publishScheduledWithFence(onPublished) {
+		await assertMediaUsageActivationWriteAllowed(this.db);
+		return publishDueContent(this.db, {
+			publish: (collection, id, options) => this.handleContentPublish(collection, id, options),
+			onPublished
+		});
 	}
 	/**
 	* Run the full scheduled-maintenance batch: cron tasks, scheduled
@@ -694,10 +2098,7 @@ var EmDashRuntime = class EmDashRuntime {
 		}
 		let published = [];
 		try {
-			published = await publishDueContent(this.db, {
-				publish: (collection, id, opts) => this.handleContentPublish(collection, id, opts),
-				onPublished: options.onPublished
-			});
+			published = await this.publishScheduledWithFence(options.onPublished);
 		} catch (error) {
 			console.error("[scheduled-publish] Sweep failed:", error);
 		}
@@ -712,8 +2113,12 @@ var EmDashRuntime = class EmDashRuntime {
 			console.error("[plugins] Storage index sync failed:", error);
 		}
 		await maybeRunScheduledBackup(this.db, this.storage ?? void 0);
+		await recordSchedulerHeartbeatSafely(this.db);
 		return { published };
 	}
+	async runScheduledMediaUsageTasks() {
+		return runScheduledMediaUsageLane(this.db);
+	}
 	/**
 	* Materialize plugin-declared storage indexes, once per process.
 	*
@@ -1013,7 +2418,7 @@ var EmDashRuntime = class EmDashRuntime {
 				});
 			}
 		};
-		const db = await phase("rt.db", "DB init + migrations", () => EmDashRuntime.getDatabase(deps));
+		const db = await phase("rt.db", "DB init + migration policy", () => EmDashRuntime.getDatabase(deps));
 		const resolveDb = () => {
 			return getRequestContext()?.db ?? db;
 		};
@@ -1032,6 +2437,14 @@ var EmDashRuntime = class EmDashRuntime {
 		const ownsConfiguredDb = !!deps.config.database && !(reqCtx?.dbIsIsolated && reqCtx.db);
 		let readDb = db;
 		let readDbDisposable;
+		const disposeReadDb = async () => {
+			const disposable = readDbDisposable;
+			readDbDisposable = void 0;
+			if (!disposable) return;
+			try {
+				await disposable.destroy();
+			} catch {}
+		};
 		if (ownsConfiguredDb && deps.createCoalescingDialect && deps.config.database) try {
 			const dialect = deps.createCoalescingDialect(deps.config.database.config);
 			if (dialect) {
@@ -1045,6 +2458,10 @@ var EmDashRuntime = class EmDashRuntime {
 			readDb = db;
 		}
 		const optionsRepo = new OptionsRepository(readDb);
+		let missingManualSchemaError;
+		const captureMissingManualSchema = (error) => {
+			if ((deps.migrationMode ?? "auto") === "manual" && isMissingTableError(error)) missingManualSchemaError ??= error;
+		};
 		const readSiteInfo = async () => {
 			const siteOpts = await optionsRepo.getMany([
 				"emdash:site_title",
@@ -1064,11 +2481,15 @@ var EmDashRuntime = class EmDashRuntime {
 			try {
 				const states = await readDb.selectFrom("_plugin_state").select(["plugin_id", "status"]).execute();
 				pluginStates = new Map(states.map((s) => [s.plugin_id, s.status]));
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		}), phase("rt.site", "Site info options", async () => {
 			try {
 				siteInfo = await readSiteInfo();
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		})];
 		if (ownsConfiguredDb) coldStartReads.push(phase("rt.seedcheck", "Auto-seed gate", async () => {
 			try {
@@ -1084,9 +2505,15 @@ var EmDashRuntime = class EmDashRuntime {
 					collectionCount: collectionCount.count,
 					setupDone
 				};
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		}));
 		await Promise.all(coldStartReads);
+		if (missingManualSchemaError) {
+			await disposeReadDb();
+			throw missingManualSchemaError;
+		}
 		if (localeCasingRepairVersion && (configuredLocales.some((locale) => locale.includes("-") || locale !== locale.toLowerCase()) || storedLocaleCasingRepairVersion !== void 0) && storedLocaleCasingRepairVersion !== localeCasingRepairVersion) await phase("rt.locale", "Repair locale casing", async () => {
 			await repairLocaleCasing(db, configuredLocales);
 			await new OptionsRepository(db).set(LOCALE_CASING_REPAIR_OPTION, localeCasingRepairVersion);
@@ -1096,9 +2523,9 @@ var EmDashRuntime = class EmDashRuntime {
 			const seedHolder = getSeedHolder();
 			try {
 				await initWithLock(seedHolder.lock, () => seedHolder.done.has(seedKey) ? true : void 0, async () => {
-					const { applySeed } = await import("../apply-kwNEJW2l.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-DV1DZuUJ.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-mKo3RxBM.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-kUDt80-G.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-YJ2xl3ra.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-BMLBvxOC.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -1115,9 +2542,7 @@ var EmDashRuntime = class EmDashRuntime {
 				} catch {}
 			} catch {}
 		}
-		if (readDbDisposable) try {
-			await readDbDisposable.destroy();
-		} catch {}
+		await disposeReadDb();
 		const enabledPlugins = /* @__PURE__ */ new Set();
 		for (const plugin of deps.plugins) {
 			const status = pluginStates.get(plugin.id);
@@ -1179,6 +2604,7 @@ var EmDashRuntime = class EmDashRuntime {
 		const pipelineFactoryOptions = {
 			db,
 			getDb: resolveDb,
+			beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(resolveDb()),
 			storage: storage ?? void 0,
 			siteInfo
 		};
@@ -1229,10 +2655,19 @@ var EmDashRuntime = class EmDashRuntime {
 				if (deps.createScheduler) {
 					const scheduler = deps.createScheduler(cronExecutor);
 					cronScheduler = scheduler;
+					const runMediaUsageMaintenance = async () => {
+						const runtime = runtimeRef.current;
+						if (runtime) await runtime.runScheduledMediaUsageTasks();
+						else await runScheduledMediaUsageLane(db);
+					};
 					scheduler.setSystemCleanup(async () => {
 						try {
 							const runtime = runtimeRef.current;
-							await publishDueContent(db, { publish: runtime ? (collection, id, options) => runtime.handleContentPublish(collection, id, options) : void 0 });
+							if (runtime) await runtime.publishScheduled();
+							else {
+								await assertMediaUsageActivationWriteAllowed(db);
+								await publishDueContent(db);
+							}
 						} catch (error) {
 							console.error("[scheduled-publish] Sweep failed:", error);
 						}
@@ -1247,7 +2682,14 @@ var EmDashRuntime = class EmDashRuntime {
 							console.error("[plugins] Storage index sync failed:", error);
 						}
 						await maybeRunScheduledBackup(db, storage ?? void 0);
+						await recordSchedulerHeartbeatSafely(db);
+						if (!scheduler.setMediaUsageMaintenance) try {
+							await runMediaUsageMaintenance();
+						} catch (error) {
+							console.error("[media-usage] Scheduled maintenance failed:", error);
+						}
 					});
+					scheduler.setMediaUsageMaintenance?.(runMediaUsageMaintenance);
 					scheduler.start();
 				}
 			} catch (error) {
@@ -1322,9 +2764,9 @@ var EmDashRuntime = class EmDashRuntime {
 				log: kyselyLogOption()
 			});
 			try {
-				await runMigrations(db);
+				await enforceRuntimeMigrationPolicy(db, deps.migrationMode ?? "auto");
 			} catch (error) {
-				if (!(error instanceof ConcurrentMigrationTimeoutError)) holder.failures.set(cacheKey, {
+				if (!(error instanceof ConcurrentMigrationTimeoutError) && !(error instanceof PendingMigrationsError)) holder.failures.set(cacheKey, {
 					at: Date.now(),
 					message: error instanceof Error ? error.message : String(error)
 				});
@@ -1407,6 +2849,7 @@ var EmDashRuntime = class EmDashRuntime {
 		if (!deps.sandboxEnabled) return sandboxedPluginCache;
 		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner(createSandboxRunnerOptions({
 			db,
+			beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(db),
 			mediaStorage: mediaStorage ? {
 				upload: (opts) => mediaStorage.upload({
 					key: opts.key,
@@ -1472,6 +2915,7 @@ var EmDashRuntime = class EmDashRuntime {
 	static async loadInstalledSandboxedPlugins(source, db, storage, deps, cache, siteInfo) {
 		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner(createSandboxRunnerOptions({
 			db,
+			beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(db),
 			mediaStorage: {
 				upload: (opts) => storage.upload({
 					key: opts.key,
@@ -1673,13 +3117,33 @@ var EmDashRuntime = class EmDashRuntime {
 					if ((field.type === "repeater" || field.type === "file" || field.type === "image") && field.validation) entry.validation = { ...field.validation };
 					fields[field.slug] = entry;
 				}
+				const configuredListColumns = collection.admin?.listColumns ?? [];
+				const fieldTypes = new Map(collection.fields.map((field) => [field.slug, field.type]));
+				const listColumns = [];
+				for (const slug of configuredListColumns) {
+					if (listColumns.includes(slug)) continue;
+					const fieldType = fieldTypes.get(slug);
+					if (!fieldType || !LIST_COLUMN_FIELD_TYPES.has(fieldType)) {
+						console.warn(`EmDash: Ignoring unsupported or unknown list column "${slug}" in collection "${collection.slug}".`);
+						continue;
+					}
+					if (listColumns.length >= MAX_COLLECTION_LIST_COLUMNS) {
+						console.warn(`EmDash: Collection "${collection.slug}" declares more than ${MAX_COLLECTION_LIST_COLUMNS} list columns; extra columns are ignored.`);
+						break;
+					}
+					listColumns.push(slug);
+				}
 				manifestCollections[collection.slug] = {
 					label: collection.label,
 					labelSingular: collection.labelSingular || collection.label,
 					supports: collection.supports || [],
 					hasSeo: collection.hasSeo,
 					urlPattern: collection.urlPattern,
+					routable: collection.routable !== false,
+					titleField: collection.titleField,
+					dateField: collection.dateField,
 					...collection.hidden ? { hidden: true } : {},
+					listColumns: listColumns.length > 0 ? listColumns : void 0,
 					fields
 				};
 			}
@@ -1739,21 +3203,33 @@ var EmDashRuntime = class EmDashRuntime {
 			};
 		}
 		let manifestTaxonomies = [];
+		let taxonomyDefinitionLocales = [];
 		try {
-			manifestTaxonomies = (await this.db.selectFrom("_emdash_taxonomy_defs").selectAll().orderBy("name").execute()).map((row) => ({
+			const rows = await this.db.selectFrom("_emdash_taxonomy_defs").selectAll().orderBy("name").execute();
+			taxonomyDefinitionLocales = rows.map((row) => row.locale);
+			manifestTaxonomies = rows.map((row) => ({
+				id: row.id,
 				name: row.name,
 				label: row.label,
 				labelSingular: row.label_singular ?? void 0,
 				hierarchical: row.hierarchical === 1,
-				collections: parseStringArray(row.collections).toSorted()
+				collections: parseStringArray(row.collections).toSorted(),
+				locale: row.locale,
+				translationGroup: row.translation_group ?? row.id
 			}));
 		} catch (error) {
 			console.debug("EmDash: Could not load taxonomy definitions:", error);
 		}
+		try {
+			const configuredLocales = virtualConfig?.i18n?.locales ?? getI18nConfig()?.locales ?? [];
+			await warnAboutUnconfiguredTaxonomyLocales(this.db, configuredLocales, taxonomyDefinitionLocales);
+		} catch (error) {
+			console.warn("[i18n] taxonomy locale diagnostic failed:", error);
+		}
 		const manifestHash = await hashString(JSON.stringify(manifestCollections) + JSON.stringify(manifestPlugins) + JSON.stringify(manifestTaxonomies));
 		const authMode = getAuthMode(this.config);
 		const authModeValue = authMode.type === "external" ? authMode.providerType : "passkey";
-		const i18nConfig = virtualConfig?.i18n;
+		const i18nConfig = virtualConfig?.i18n ?? getI18nConfig();
 		const i18n = i18nConfig && i18nConfig.locales && i18nConfig.locales.length > 1 ? {
 			defaultLocale: i18nConfig.defaultLocale,
 			locales: i18nConfig.locales
@@ -1769,6 +3245,10 @@ var EmDashRuntime = class EmDashRuntime {
 			taxonomies: manifestTaxonomies,
 			authMode: authModeValue,
 			i18n,
+			contentLocale: {
+				defaultLocale: i18nConfig?.defaultLocale ?? "en",
+				implicit: i18nConfig === null
+			},
 			marketplace: !!this.config.marketplace,
 			registry
 		};
@@ -1874,7 +3354,7 @@ var EmDashRuntime = class EmDashRuntime {
 		if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(body.data, collection, true)).content;
 		processedData = await this.runSandboxedBeforeSave(processedData, collection, true);
 		processedData = await this.normalizeMediaFields(collection, processedData);
-		const { validateContentData } = await import("../validation-BgpucsvF.mjs");
+		const { validateContentData } = await import("../validation-npvENUCB.mjs");
 		const validation = await validateContentData(this.db, collection, processedData, { partial: false });
 		if (!validation.ok) return {
 			success: false,
@@ -1917,7 +3397,7 @@ var EmDashRuntime = class EmDashRuntime {
 			if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(bodyWithoutRev.data, collection, false)).content;
 			processedData = await this.runSandboxedBeforeSave(processedData, collection, false);
 			processedData = await this.normalizeMediaFields(collection, processedData);
-			const { validateContentData } = await import("../validation-BgpucsvF.mjs");
+			const { validateContentData } = await import("../validation-npvENUCB.mjs");
 			const validation = await validateContentData(this.db, collection, processedData, { partial: true });
 			if (!validation.ok) return {
 				success: false,
@@ -2233,13 +3713,16 @@ var EmDashRuntime = class EmDashRuntime {
 	}
 	async refreshContentUsageAfterSuccessfulWrite(collection, contentIds) {
 		for (const contentId of new Set(contentIds)) try {
+			if ((await processMediaUsageWorkAfterWrite(this.db, collection, contentId)).outcome !== "inactive") return;
 			await refreshContentMediaUsageAfterWrite(this.db, collection, contentId);
 		} catch (error) {
 			console.error(`[media-usage] Failed after content write ${collection}/${contentId}:`, error);
+			return;
 		}
 	}
 	async deleteContentUsageAfterSuccessfulPermanentDelete(collection, contentId) {
 		try {
+			if ((await processMediaUsageWorkAfterWrite(this.db, collection, contentId)).outcome !== "inactive") return;
 			const result = await deleteContentMediaUsage(this.db, collection, contentId);
 			if (!result.success) console.error(`[media-usage] Usage delete for ${collection}/${contentId} finished with ${result.errorCode}`);
 		} catch (error) {
@@ -2285,7 +3768,7 @@ var EmDashRuntime = class EmDashRuntime {
 		if (!meta) return null;
 		return meta.admin?.settingsSchema ?? {};
 	}
-	async handlePluginApiRoute(pluginId, _method, path, request) {
+	async handlePluginApiRoute(pluginId, _method, path, request, user) {
 		if (!this.isPluginEnabled(pluginId)) return {
 			success: false,
 			error: {
@@ -2293,6 +3776,7 @@ var EmDashRuntime = class EmDashRuntime {
 				message: `Plugin not enabled: ${pluginId}`
 			}
 		};
+		const caller = user ? toRouteCallerInfo(user) : void 0;
 		const trustedPlugin = this.configuredPlugins.find((p) => p.id === pluginId);
 		if (trustedPlugin && this.enabledPlugins.has(trustedPlugin.id)) {
 			const routeRegistry = new PluginRouteRegistry({
@@ -2306,11 +3790,12 @@ var EmDashRuntime = class EmDashRuntime {
 			const body = await parseRouteInput(request);
 			return routeRegistry.invoke(pluginId, routeKey, {
 				request,
-				body
+				body,
+				user: caller
 			});
 		}
 		const sandboxedPlugin = this.findSandboxedPlugin(pluginId);
-		if (sandboxedPlugin) return this.handleSandboxedRoute(sandboxedPlugin, path, request);
+		if (sandboxedPlugin) return this.handleSandboxedRoute(sandboxedPlugin, path, request, caller);
 		return {
 			success: false,
 			error: {
@@ -2385,7 +3870,7 @@ var EmDashRuntime = class EmDashRuntime {
 			...tool.outputSchema ? { outputSchema: z.toJSONSchema(tool.outputSchema, { target: "draft-7" }) } : {}
 		})).toSorted((a, b) => a.name.localeCompare(b.name)));
 	}
-	async handlePluginMcpTool(pluginId, toolName, route, input, actorId, request) {
+	async handlePluginMcpTool(pluginId, toolName, route, input, actorId, request, caller) {
 		const requestMeta = extractRequestMeta(request, getTrustedProxyHeaders(this.config));
 		const audit = new AuditRepository(this.db);
 		const headers = new Headers(request.headers);
@@ -2396,7 +3881,7 @@ var EmDashRuntime = class EmDashRuntime {
 			headers,
 			body: JSON.stringify(input)
 		});
-		const result = await this.handlePluginApiRoute(pluginId, "POST", route, internalRequest);
+		const result = await this.handlePluginApiRoute(pluginId, "POST", route, internalRequest, caller);
 		await audit.log({
 			actorId,
 			actorIp: requestMeta.ip ?? void 0,
@@ -2625,7 +4110,7 @@ var EmDashRuntime = class EmDashRuntime {
 	runAfterUnscheduleHooks(content, collection) {
 		this.runDeferredContentHook("content:afterUnschedule", content, collection);
 	}
-	async handleSandboxedRoute(plugin, path, request) {
+	async handleSandboxedRoute(plugin, path, request, user) {
 		const routeName = path.replace(LEADING_SLASH_PATTERN, "");
 		const body = await parseRouteInput(request);
 		try {
@@ -2637,11 +4122,21 @@ var EmDashRuntime = class EmDashRuntime {
 					url: request.url,
 					method: request.method,
 					headers,
-					meta
+					meta,
+					user
 				})
 			};
 		} catch (error) {
 			console.error(`EmDash: Sandboxed plugin route error:`, error);
+			const sandboxRouteError = getSandboxRouteErrorDetails(error);
+			if (sandboxRouteError) return {
+				success: false,
+				status: sandboxRouteError.status,
+				error: {
+					code: sandboxRouteError.code,
+					message: sandboxRouteError.message
+				}
+			};
 			return {
 				success: false,
 				error: {
@@ -2760,6 +4255,21 @@ function createPublicMediaUrlResolver(storage) {
 * middleware.ts.
 */
 const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
+/**
+* Whether the request ended authenticated, for the db adapter's `commit()`.
+* `isAuthenticated` is captured before the route runs, so it misses
+* login/signup/invite requests that create the Astro session mid-request;
+* `session.set()` writes the `astro-session` cookie into the jar synchronously,
+* so scanning the outgoing cookies detects them. Only outgoing cookies count —
+* a stale `astro-session` cookie arriving on an anonymous render must not
+* qualify, or its replica-read bookmark would overwrite a fresher one from an
+* earlier authenticated write.
+*/
+function requestEndedAuthenticated(isAuthenticated, cookies) {
+	if (isAuthenticated) return true;
+	for (const header of cookies.headers()) if (header.startsWith("astro-session=")) return true;
+	return false;
+}
 /** Hold the real adapter close behind both response and deferred-task completion. */
 function coordinateScopedDbLifecycle(scoped) {
 	if (!scoped.close) return { lifecycle: scoped };
@@ -3021,12 +4531,6 @@ function createPublicPluginApiRouteHandler(runtime) {
 //#endregion
 //#region src/astro/middleware.ts
 /**
-* EmDash middleware
-*
-* Thin wrapper that initializes EmDashRuntime and attaches it to locals.
-* All heavy lifting happens in EmDashRuntime.
-*/
-/**
 * Runtime init lock reclaim deadline. Must be strictly larger than the db
 * init deadline: this lock wraps EmDashRuntime.create() → getDatabase() →
 * the db init lock, and equal deadlines would let this outer lock reclaim
@@ -3112,10 +4616,11 @@ function getPlugins() {
 /**
 * Build runtime dependencies from virtual modules
 */
-function buildDependencies(config) {
+function buildDependencies(config, migrationMode) {
 	const sandboxModule = virtualSandboxRunnerModule;
 	return {
 		config,
+		migrationMode,
 		plugins: getPlugins(),
 		createDialect,
 		createCoalescingDialect,
@@ -3136,10 +4641,10 @@ function buildDependencies(config) {
 * cached instance) push nothing — callers should treat an empty array
 * as "warm, nothing to report".
 */
-async function getRuntime(config, initTimings) {
+async function getRuntime(config, migrationMode, initTimings) {
 	const holder = getRuntimeHolder();
 	return initWithLock(holder.lock, () => holder.instance, async (isCurrentClaim) => {
-		const deps = buildDependencies(config);
+		const deps = buildDependencies(config, migrationMode);
 		const runtime = await EmDashRuntime.create(deps, initTimings);
 		if (isCurrentClaim()) holder.instance = runtime;
 		else runtime.stopCron().catch((error) => {
@@ -3170,6 +4675,15 @@ async function runScheduledTasks(options = {}) {
 	if (!config) return { published: [] };
 	return runOutsideRequest(config, (runtime) => runtime.runScheduledTasks(options));
 }
+async function runScheduledMediaUsageTasks() {
+	const config = getConfig();
+	if (!config) return {
+		outcome: "inactive",
+		taskClass: null,
+		turn: null
+	};
+	return runOutsideRequest(config, (runtime) => runtime.runScheduledMediaUsageTasks());
+}
 /**
 * Run a callback against the EmDash runtime outside any HTTP request — from a
 * Cloudflare Queue consumer, a `scheduled()` handler, or any other
@@ -3213,19 +4727,37 @@ async function withEmDashRuntime(run) {
 /**
 * Shared plumbing for request-free entry points (`runScheduledTasks`,
 * `withEmDashRuntime`): resolve the runtime singleton, then run the callback
-* under an event-scoped db connection when the adapter needs one.
+* under an event-scoped db when the adapter needs one.
 *
 * Connection-backed adapters (e.g. Postgres over Hyperdrive) cannot reuse
 * the per-isolate singleton from a platform event: its socket belongs to the
 * request that opened it, and workerd rejects cross-event I/O. Open an
 * event-scoped connection and run the callback under it in ALS — the
 * runtime's db getter, the cron executor, and plugin contexts all resolve
-* the connection from ALS — then close it. Gated on the adapter being
-* connection-backed (it exposes `close()`); stateless adapters (D1, Node
-* SQLite) return null or a close-less scope and keep using the singleton.
+* the connection from ALS — then close it when required. Stateless adapters
+* that need primary routing can return a close-less scope; adapters with no
+* event scoping return null and keep using the singleton.
 */
 async function runOutsideRequest(config, fn) {
-	const runtime = await getRuntime(config);
+	const migrationMode = resolveConfiguredMigrationMode(config);
+	if (getRequestContext()) return runOutsideRequestWithRuntime(config, await getRuntime(config, migrationMode), fn);
+	const deferredTasks = createDeferredTaskTracker(() => {});
+	return runWithContext({
+		editMode: false,
+		metrics: createRequestMetrics(performance.now()),
+		deferredTasks
+	}, async () => {
+		return runOutsideRequestWithRuntime(config, await (async () => {
+			try {
+				return await getRuntime(config, migrationMode);
+			} finally {
+				deferredTasks.settle();
+				await deferredTasks.settled;
+			}
+		})(), fn);
+	});
+}
+async function runOutsideRequestWithRuntime(config, runtime, fn) {
 	const scoped = createRequestScopedDb$1({
 		config: config.database?.config,
 		isAuthenticated: false,
@@ -3234,7 +4766,7 @@ async function runOutsideRequest(config, fn) {
 		cookies: NOOP_COOKIE_JAR,
 		url: CRON_EVENT_URL
 	});
-	if (!scoped?.close) return fn(runtime);
+	if (!scoped) return fn(runtime);
 	const { closed, deferredTasks, lifecycle } = coordinateScopedDbLifecycle(scoped);
 	const parent = getRequestContext();
 	const ctx = parent ? {
@@ -3280,6 +4812,24 @@ const NOOP_COOKIE_JAR = {
 * that path, so the value is never used — it exists to satisfy the contract.
 */
 const CRON_EVENT_URL = new URL("https://cron.emdash.internal/");
+function resolveConfiguredMigrationMode(config) {
+	const processOverride = typeof process !== "undefined" && process.env ? process.env.EMDASH_MIGRATIONS_MODE : void 0;
+	const importMetaOverride = import.meta.env.EMDASH_MIGRATIONS_MODE;
+	return resolveRuntimeMigrationMode(config.migrations, {
+		dev: import.meta.env.DEV,
+		override: processOverride ?? importMetaOverride
+	});
+}
+function pendingMigrationsResponse(error) {
+	console.error("[emdash] database migrations are pending:", error.pending.join(", "));
+	return migrationRequiredResponse();
+}
+function migrationRequiredResponse() {
+	return new Response("Database migrations are required. Apply the deployment migration manifest and retry.", {
+		status: 503,
+		headers: { "Retry-After": "60" }
+	});
+}
 /**
 * Baseline security headers applied to all responses.
 * Admin routes get additional headers (strict CSP) from auth middleware.
@@ -3359,15 +4909,44 @@ function createRequestScopedDb$1(opts) {
 	if (typeof createRequestScopedDb !== "function") return null;
 	return createRequestScopedDb(opts);
 }
+const buildDate = buildTime ? new Date(buildTime) : null;
+/**
+* Fold the build timestamp into the route cache validator.
+*
+* `CacheHint.lastModified` describes the content, but the response also depends
+* on the build: `/_astro/*` names are content-hashed, and a deployment only
+* serves its own. Without the build dimension a code-only deploy answers a
+* returning visitor's conditional request with 304, leaving them on HTML whose
+* assets 404.
+*
+* Prerendered pages are served by the host's static layer, which manages its
+* own validators — only on-demand responses need the build dimension.
+*
+* Only forward moves are covered. `Last-Modified` expresses newer, not
+* different, so after a rollback the earlier build still answers a conditional
+* request with 304 and the browser stays on the newer build's HTML.
+*
+* Must run before next(): Astro keeps the later of two dates, so a route's own
+* hint still wins when content is newer, and a route that opts out with
+* `Astro.cache.set(false)` stays opted out — calling set() afterwards would
+* clear that opt-out.
+*/
+function applyBuildValidator(context) {
+	if (context.isPrerendered || !buildDate || !context.cache?.enabled) return;
+	context.cache.set({ lastModified: buildDate });
+}
 const onRequest = defineMiddleware(async (context, next) => {
 	const { request, locals, cookies } = context;
 	const url = context.url;
 	if (!url.pathname.startsWith("/_emdash") && virtualConfig?.authProviders) {
 		if (virtualConfig.authProviders.some((p) => p.routes?.some((r) => r.pattern && url.pathname === r.pattern))) return finalizeResponse(await next());
 	}
+	applyBuildValidator(context);
 	const queryRecorder = isInstrumentationEnabled() ? createRecorder(url.pathname, request.method, request.headers.get("x-perf-phase") ?? "default") : void 0;
 	const metrics = createRequestMetrics(performance.now());
 	const run = async () => {
+		const config = getConfig();
+		const migrationMode = config ? resolveConfiguredMigrationMode(config) : "auto";
 		const isEmDashRoute = url.pathname.startsWith("/_emdash");
 		const isPublicRuntimeRoute = PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
 		const hasEditCookie = cookies.get("emdash-edit-mode")?.value === "true";
@@ -3378,15 +4957,16 @@ const onRequest = defineMiddleware(async (context, next) => {
 		const hasBearerAuth = (request.headers.get("authorization") ?? "").toLowerCase().startsWith("bearer ");
 		const isWrite = request.method !== "GET" && request.method !== "HEAD";
 		const isAuthenticated = !!sessionUser || hasBearerAuth;
+		const endedAuthenticated = () => requestEndedAuthenticated(isAuthenticated, cookies);
 		const canUseCachedBinding = !isAuthenticated && !isWrite && !playgroundDb && !isEmDashRoute && !hasEditCookie && !hasPreviewToken;
 		if (!isEmDashRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
 			if (!sessionUser && !playgroundDb) {
 				const timings = [];
 				const mwStart = performance.now();
-				if (!isSetupVerified() && !context.isPrerendered) {
+				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
-						const { getDb } = await import("../loader-CGugY7Zl.mjs").then((n) => n.s);
+						const { getDb } = await import("../loader-CdG_Ci3H.mjs").then((n) => n.c);
 						await (await getDb()).selectFrom("_emdash_migrations").selectAll().limit(1).execute();
 						markSetupVerified();
 					} catch (error) {
@@ -3399,12 +4979,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 						desc: "Setup probe"
 					});
 				}
-				const config = getConfig();
 				if (config) {
 					const initSubTimings = [];
 					const t0 = performance.now();
 					try {
-						const runtime = await getRuntime(config, initSubTimings);
+						const runtime = await getRuntime(config, migrationMode, initSubTimings);
 						markSetupVerified();
 						locals.emdash = {
 							handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
@@ -3414,6 +4993,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 							storage: runtime.storage
 						};
 					} catch (error) {
+						if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+						if (migrationMode === "manual" && isMissingTableError(error)) {
+							console.error("[emdash] database schema is unavailable in manual migration mode:", error);
+							return migrationRequiredResponse();
+						}
 						if (Date.now() - lastRuntimeInitErrorLogAt >= RUNTIME_INIT_ERROR_LOG_INTERVAL_MS) {
 							lastRuntimeInitErrorLogAt = Date.now();
 							console.error("[emdash] runtime init failed (page renders without CMS data):", error);
@@ -3430,6 +5014,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 				const anonScoped = createRequestScopedDb$1({
 					config: config?.database?.config,
 					isAuthenticated,
+					endedAuthenticated,
 					isWrite,
 					canUseCachedBinding,
 					cookies,
@@ -3474,7 +5059,6 @@ const onRequest = defineMiddleware(async (context, next) => {
 				return runAnon();
 			}
 		}
-		const config = getConfig();
 		if (!config) {
 			console.error("EmDash: No configuration found");
 			return finalizeResponse(await next());
@@ -3485,7 +5069,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 			try {
 				const initSubTimings = [];
 				let t0 = performance.now();
-				const runtime = await getRuntime(config, initSubTimings);
+				const runtime = await getRuntime(config, migrationMode, initSubTimings);
 				timings.push({
 					name: "rt",
 					dur: performance.now() - t0,
@@ -3554,12 +5138,18 @@ const onRequest = defineMiddleware(async (context, next) => {
 					setPluginStatus: runtime.setPluginStatus.bind(runtime)
 				};
 			} catch (error) {
+				if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+				if (migrationMode === "manual" && isMissingTableError(error)) {
+					console.error("[emdash] database schema is unavailable in manual migration mode:", error);
+					return migrationRequiredResponse();
+				}
 				console.error("EmDash middleware error:", error);
 			}
 			const lastContentWriteAt = canUseCachedBinding && config?.database?.needsLastContentWriteAt ? await getLastContentWriteAt() : void 0;
 			const scoped = createRequestScopedDb$1({
 				config: config?.database?.config,
 				isAuthenticated,
+				endedAuthenticated,
 				isWrite,
 				canUseCachedBinding,
 				cookies: context.cookies,
@@ -3627,5 +5217,5 @@ const onRequest = defineMiddleware(async (context, next) => {
 });
 
 //#endregion
-export { onRequest as default, onRequest, runScheduledTasks, withEmDashRuntime };
+export { onRequest as default, onRequest, runScheduledMediaUsageTasks, runScheduledTasks, withEmDashRuntime };
 //# sourceMappingURL=middleware.mjs.map