emdash 0.34.0 → 0.36.0

package/dist/astro/middleware.mjs

@@ -1,100 +1,106 @@
-import { a as runMigrations, n as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "../runner-BiDvq5dv.mjs";
-import { t as validateIdentifier } from "../validate-BpwoDOgt.mjs";
-import { c as isSqlite, p as tableExists, s as isPostgres, u as listTablesLike } from "../dialect-helpers-BSbfaO3F.mjs";
+import { r as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "../runner-77GOZCnH.mjs";
+import { c as isSqlite, u as listTablesLike } from "../dialect-helpers-BSbfaO3F.mjs";
 import { r as getI18nConfig, s as setI18nConfig } from "../config-C3EBstHi.mjs";
-import { C as createHookPipeline, M as AuditRepository, T as definePlugin, _ as PluginRouteRegistry, b as toRouteCallerInfo, c as getSandboxRouteErrorDetails, t as getMenu, v as buildRouteMeta, w as resolveExclusiveHooks, x as EmailPipeline, y as parseRouteInput } from "../menus-CC-yn1F9.mjs";
+import { C as isContentSaveRejection, D as definePlugin, E as resolveExclusiveHooks, P as AuditRepository, T as createHookPipeline, _ as PluginRouteRegistry, b as toRouteCallerInfo, c as getSandboxRouteErrorDetails, t as getMenu, v as buildRouteMeta, x as EmailPipeline, y as parseRouteInput } from "../menus-CNg0QlDt.mjs";
 import { n as createDeferredTaskTracker, t as after } from "../after-CBU2vkoO.mjs";
 import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
 import { o as getLastContentWriteAt } from "../object-cache-71tPfV4A.mjs";
 import { i as MAX_COLLECTION_LIST_COLUMNS } from "../types-75KIqzL9.mjs";
-import { i as RevisionRepository, t as ContentRepository } from "../content-BNfwh7xX.mjs";
+import { i as RevisionRepository, t as ContentRepository } from "../content-CP-SeXNa.mjs";
 import { n as isMissingTableError } from "../db-errors-Cl-sKYTm.mjs";
 import "../slugify-B994zkXC.mjs";
 import "../base64-CvLhUKQv.mjs";
 import { n as ContentMutationConflictError } from "../types-CQPWhPxE.mjs";
-import { t as MediaRepository } from "../media-CzhAn2--.mjs";
-import "../user-sHgJ62SP.mjs";
-import { t as withTransaction } from "../transaction-NQj4VJ7Z.mjs";
-import "../taxonomy-CPeM8d2o.mjs";
-import "../comment-Dxlep6cE.mjs";
-import { t as OptionsRepository } from "../options-CBXIHUoT.mjs";
-import { r as createSiteInfo } from "../context-DRgOvSnW.mjs";
-import "../menus-fxvEDYE6.mjs";
-import "../redirect-COsS6SWJ.mjs";
-import { i as setRequestCacheEntry, r as requestCached } from "../request-cache-BSUptuJR.mjs";
-import "../byline-registry-DDun8sxh.mjs";
-import { n as initWithLock, t as createInitLock } from "../init-lock-6b309ZrF.mjs";
-import "../field-defs-cache-hg6QkjV9.mjs";
-import "../byline-pEcoDps8.mjs";
-import "../relation-DtmAQH7s.mjs";
-import { n as normalizeMediaValue } from "../normalize-Bc-s_r-a.mjs";
-import "../dist-D_6CKR8z.mjs";
-import "../enrich-_ySMEvEE.mjs";
-import "../seo-CvDxfvFb.mjs";
-import { r as singleFlightCached, t as createSingleFlightCache } from "../single-flight-cache-B0eLKS6K.mjs";
-import "../cache-CBJaDy_E.mjs";
-import { t as FTSManager } from "../fts-manager-CZ-5dVwJ.mjs";
-import "../resolve-DOhVEvty.mjs";
+import { t as MediaRepository } from "../media-D6SeAfBl.mjs";
+import "../user-CtYY0tp2.mjs";
+import "../taxonomy-8X09dLN5.mjs";
+import "../comment-DhvLEdhQ.mjs";
+import { t as OptionsRepository } from "../options-BHPeIbBd.mjs";
+import { r as createSiteInfo } from "../context-BR5hRWiK.mjs";
+import "../menus-CD7EFLwz.mjs";
+import "../redirect-CZkbozu9.mjs";
+import { i as setRequestCacheEntry, r as requestCached } from "../request-cache-DH9zdCOD.mjs";
+import "../byline-registry-Bpu9-MVs.mjs";
+import { n as initWithLock, t as createInitLock } from "../init-lock-DJkX6Hto.mjs";
+import "../field-defs-cache-Bh4q6oar.mjs";
+import "../byline-Cpnwrje1.mjs";
+import "../relation-A6wLF_DS.mjs";
+import { n as normalizeMediaValue } from "../normalize-CSxdKBVa.mjs";
+import "../dist-89xCrGqi.mjs";
+import "../enrich-BX0IDp4z.mjs";
+import "../seo-Cm-dtvgk.mjs";
+import { r as singleFlightCached, t as createSingleFlightCache } from "../single-flight-cache-BPuGPdcN.mjs";
+import "../cache-5VirJ2Cn.mjs";
+import { t as FTSManager } from "../fts-manager-BhOdW0bi.mjs";
+import "../resolve-DxUpTMmE.mjs";
 import { createRecorder, flushRecorder, isInstrumentationEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
-import { s as getDb } from "../loader-DLBqRiGP.mjs";
-import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-B0o9ExNV.mjs";
-import { $ as handleContentUnschedule, A as handleMediaUpdate, B as handleContentDelete, D as handleMediaDelete, E as handleMediaCreate, F as handleContentAuthors, G as handleContentList, H as handleContentDuplicate, I as handleContentCompare, J as handleContentPublish, K as handleContentListTrashed, L as handleContentCountScheduled, M as handleRevisionList, N as handleRevisionRestore, O as handleMediaGet, Q as handleContentUnpublish, R as handleContentCountTrashed, U as handleContentGet, V as handleContentDiscardDraft, W as handleContentGetIncludingTrashed, X as handleContentSchedule, Y as handleContentRestore, Z as handleContentTranslations, _ as loadBundleFromR2, et as handleContentUpdate, j as handleRevisionGet, k as handleMediaList, q as handleContentPermanentDelete, s as normalizeRegistryConfig, tt as validateRev, v as syncDeclaredStorageIndexes, z as handleContentCreate } from "../api-DdAsirBe.mjs";
-import { n as recordSchedulerHeartbeatSafely } from "../dashboard-CB8J89rJ.mjs";
-import { r as hashString } from "../hash-Cg0TXJPV.mjs";
-import { _ as loadContentMediaUsageFields, a as findNonTranslatableSiblingContentIds, g as buildContentMediaUsageFieldFingerprint, l as refreshContentMediaUsageAfterWrite, r as deleteContentMediaUsage, s as markContentMediaUsageCollectionStale, u as refreshContentMediaUsageForWork, v as CONTENT_SOURCE_SCHEMA_VERSION, y as MediaUsageRepository } from "../content-refresh-DNERP4-f.mjs";
-import { t as MediaUsageWorkRepository } from "../media-usage-work-DrCbqBcl.mjs";
-import "../media-usage-De3qvwjc.mjs";
-import { n as collectionDeletionCurrentTimestamp, r as deleteActivatedMediaUsageCollection, t as MediaUsageCollectionDeletionRepository } from "../collection-deletion-C8BugSGz.mjs";
-import "../media-usage-work-B9Bksh_b.mjs";
-import { n as SchemaRegistry } from "../registry-C581V4TP.mjs";
-import "../query-vgZNwIhh.mjs";
-import "../zod-generator-D11MhxG4.mjs";
-import "../schema-BFyTg38T.mjs";
-import "../schema-CeQSNwB3.mjs";
-import "../seo-AFpVvTqr.mjs";
-import { t as PluginStateRepository } from "../state-DYwPue40.mjs";
-import "../sections-COctk6hf.mjs";
-import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-B372MV0p.mjs";
-import "../settings-BE9aqn_9.mjs";
-import "../taxonomies-Dk3MAklL.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-BXbUAHod.mjs";
-import "../types-CP1CflWf.mjs";
-import "../ssrf-Cpvg_n3A.mjs";
-import "../error-DupyJZE2.mjs";
-import "../parse-DFbuc-Fh.mjs";
-import "../media-BWWWb8kg.mjs";
-import "../redirects-cV9g7V-0.mjs";
-import "../relations-BBApI4e2.mjs";
-import "../status-CWVYpbD8.mjs";
-import { a as invalidateUrlPatternCache } from "../query-BgjfiLUQ.mjs";
-import "../import-B41u8Rot.mjs";
-import { t as getTrustedProxyHeaders } from "../trusted-proxy-CEVekpby.mjs";
-import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DgZJh3zG.mjs";
-import "../ssrf-DpXgKsna.mjs";
-import { n as CronExecutor } from "../cron-Y9aLtgrA.mjs";
-import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-BHNjIwiB.mjs";
-import { n as assertMediaUsageActivationWriteAllowed } from "../media-usage-write-fence-aHEgN1zB.mjs";
-import "../utils-D4vD_Y98.mjs";
-import "../tokens-C39klX8R.mjs";
-import "../preview-PW-nOnq4.mjs";
-import "../hreflang-DNswoYsi.mjs";
-import "../comment-reaction-D6qfHKBc.mjs";
-import "../bylines-BWemdX2k.mjs";
-import { n as getWidgetAreas } from "../widgets-Cwzvww0W.mjs";
-import "../validate-BkqIG_Uj.mjs";
-import "../apply-D5zfeD09.mjs";
-import "../load-DmvJrtxS.mjs";
-import "../search-BpuPKZb0.mjs";
+import { s as getDb } from "../loader-ZsjE4paL.mjs";
+import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-kmyudNGP.mjs";
+import { A as handleContentPublish, C as handleContentDiscardDraft, D as handleContentList, E as handleContentGetIncludingTrashed, F as handleContentUnschedule, I as handleContentUpdate, L as validateRev, M as handleContentSchedule, N as handleContentTranslations, O as handleContentListTrashed, P as handleContentUnpublish, S as handleContentDelete, T as handleContentGet, _ as handleContentAuthors, b as handleContentCountTrashed, c as handleMediaCreate, d as handleMediaList, f as handleMediaUpdate, h as handleRevisionRestore, j as handleContentRestore, k as handleContentPermanentDelete, l as handleMediaDelete, m as handleRevisionList, p as handleRevisionGet, u as handleMediaGet, v as handleContentCompare, w as handleContentDuplicate, x as handleContentCreate, y as handleContentCountScheduled } from "../api-B0w3uBiG.mjs";
+import { n as recordSchedulerHeartbeatSafely } from "../dashboard-CkIV2rnQ.mjs";
+import { r as hashString } from "../hash-CTcngWvj.mjs";
+import "../media-folders-D-0CmRZj.mjs";
+import "../capture-triggers-CNW1q3HK.mjs";
+import { r as activateMediaUsageCapture } from "../activation-K0kGBWuJ.mjs";
+import { c as markContentMediaUsageCollectionStale, i as deleteContentMediaUsage, o as findNonTranslatableSiblingContentIds, u as refreshContentMediaUsageAfterWrite, y as MediaUsageRepository } from "../content-refresh-DLOfIhYc.mjs";
+import "../media-usage-work-C-fhM30c.mjs";
+import "../content-repair-BCxzy0r4.mjs";
+import "../collection-deletion-m_oi2c0N.mjs";
+import { s as processMediaUsageWorkAfterWrite } from "../media-usage-BTRJvS6V.mjs";
+import { t as ErrorCode } from "../errors-n2j49uNf.mjs";
+import "../media-usage-activation-Dx0kPV6b.mjs";
+import "../media-usage-work-DWb2XPMI.mjs";
+import { n as SchemaRegistry } from "../registry-Cx-jEJOS.mjs";
+import "../query-tZDEdtCN.mjs";
+import "../zod-generator-DylzusHh.mjs";
+import "../schema-BY-oVntF.mjs";
+import "../schema-Cw9kVK0I.mjs";
+import "../seo-BSiTIXzd.mjs";
+import { t as PluginStateRepository } from "../state-BJfU9Uzw.mjs";
+import "../sections-DTfjyf1z.mjs";
+import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-BgN-0DT-.mjs";
+import "../settings-DjtkUo__.mjs";
+import "../taxonomies-CPGxo-bn.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-CUYPfCEH.mjs";
+import { s as normalizeRegistryConfig, v as loadBundleFromR2, y as syncDeclaredStorageIndexes } from "../registry-BiO5WwPq.mjs";
+import "../types-D6OcIp2P.mjs";
+import "../ssrf-DqebVE34.mjs";
+import "../error-D9w94fjV.mjs";
+import "../parse-BRJg1kz8.mjs";
+import "../media-BjwNuLEu.mjs";
+import "../redirects-CRIM55KH.mjs";
+import "../relations-BTPM2saV.mjs";
+import "../status-DDu8HIQl.mjs";
+import { a as invalidateUrlPatternCache } from "../query-D18vTdha.mjs";
+import "../import-C4_O3KXU.mjs";
+import { t as getTrustedProxyHeaders } from "../trusted-proxy-fe6nEgR4.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DRp5ENd_.mjs";
+import "../ssrf-BPKzkm6O.mjs";
+import { n as CronExecutor } from "../cron-CWfWrWKG.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-CEJgR_LB.mjs";
+import { n as assertMediaUsageActivationWriteAllowed } from "../media-usage-write-fence-BwoJVRDC.mjs";
+import "../utils-HztC73hq.mjs";
+import "../tokens-gTS-IVUp.mjs";
+import "../preview-dn2dUyM0.mjs";
+import "../hreflang-Huc6O5wa.mjs";
+import "../comment-reaction-CRuItEjt.mjs";
+import "../bylines-BSo9B9RX.mjs";
+import { n as getWidgetAreas } from "../widgets-CpmZd9Q-.mjs";
+import "../validate-Dd-IUjnZ.mjs";
+import "../apply-B_VMpJ2P.mjs";
+import "../load-Bo7fZAbg.mjs";
+import "../search-CfT3KxO5.mjs";
 import "../index.mjs";
-import { n as VERSION, t as COMMIT } from "../version-x0NjTScG.mjs";
-import { t as getAuthMode } from "../mode-Bpe-tNNy.mjs";
-import "../snapshot-B5h6aPMh.mjs";
-import { u as maybeRunScheduledBackup } from "../backup-LHjIAVNP.mjs";
-import { t as cleanupExpiredChallenges } from "../challenge-store-CZyFVaad.mjs";
-import { t as removeUploadAttempt } from "../upload-attempts-hlne3iA1.mjs";
-import { a as validateEncryptionKeyAtStartup } from "../secrets-dtYs2hDo.mjs";
+import { i as resolveRuntimeMigrationMode, n as enforceRuntimeMigrationPolicy, t as PendingMigrationsError } from "../policy-BVRganJQ.mjs";
+import { n as VERSION, t as COMMIT } from "../version-ri-sCyAp.mjs";
+import { t as getAuthMode } from "../mode-DaUM_MB2.mjs";
+import "../snapshot-DSB8P7Lm.mjs";
+import { u as maybeRunScheduledBackup } from "../backup-ChyHfIoX.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-D5pSY2S1.mjs";
+import { t as removeUploadAttempt } from "../upload-attempts-CNyGSepg.mjs";
+import { a as validateEncryptionKeyAtStartup } from "../secrets-BH2Qow1-.mjs";
 import { isRecord } from "../plugin-utils.mjs";
-import { t as resolveSessionUser } from "../session-user-BzVemLkw.mjs";
+import { t as resolveSessionUser } from "../session-user-CNAfvsdw.mjs";
 import { Kysely, sql } from "kysely";
 import { ulid } from "ulidx";
 import { z } from "zod";
@@ -157,1145 +163,6 @@ async function warnAboutUnconfiguredTaxonomyLocales(db, configuredLocales, defin
 	console.warn(`EmDash: Taxonomy rows use locales outside the configured locales (${supportedLocales.join(", ")}): ${details}. Locale-scoped reads may not return these rows. Review and repair them explicitly: ${REPAIR_GUIDE}`);
 }
 
-//#endregion
-//#region src/media/usage/collection-deletion-processor.ts
-const MEDIA_USAGE_COLLECTION_DELETION_LIMITS = Object.freeze({
-	candidatesPerTick: 4,
-	deletionsPerTick: 1,
-	rowsPerBatch: 50,
-	leaseDurationSeconds: 300,
-	maxAttempts: 5,
-	retryBaseSeconds: 30,
-	retryMaxSeconds: 900,
-	maxQueriesPerTick: 30
-});
-async function processDueMediaUsageCollectionDeletions(db) {
-	const repository = new MediaUsageCollectionDeletionRepository(db);
-	const candidates = await repository.findDue(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.candidatesPerTick);
-	if (candidates.length === 0) return {
-		candidateCount: 0,
-		claimedCount: 0,
-		outcome: "idle"
-	};
-	let claim = null;
-	for (const candidate of candidates) {
-		claim = await repository.claim({
-			collectionId: candidate.collectionId,
-			phase: candidate.phase,
-			leaseDurationSeconds: MEDIA_USAGE_COLLECTION_DELETION_LIMITS.leaseDurationSeconds
-		});
-		if (claim?.leaseToken) break;
-	}
-	if (!claim?.leaseToken) return {
-		candidateCount: candidates.length,
-		claimedCount: 0,
-		outcome: "claim_lost"
-	};
-	try {
-		const processed = await processClaimedDeletion(db, claim);
-		if (!processed.finalized && !processed.released && !await repository.release(claim)) return {
-			candidateCount: candidates.length,
-			claimedCount: 1,
-			outcome: "claim_lost"
-		};
-		return {
-			candidateCount: candidates.length,
-			claimedCount: 1,
-			outcome: processed.finalized ? "finalized" : "progress"
-		};
-	} catch (error) {
-		const terminal = claim.attemptCount + 1 >= MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxAttempts;
-		if (!await repository.recordFailure({
-			collectionId: claim.collectionId,
-			leaseToken: claim.leaseToken,
-			errorCode: "MEDIA_USAGE_COLLECTION_DELETION_FAILED",
-			terminal,
-			retryDelaySeconds: retryDelaySeconds$2(claim.attemptCount)
-		})) return {
-			candidateCount: candidates.length,
-			claimedCount: 1,
-			outcome: "claim_lost"
-		};
-		console.error("[media-usage:collection-deletion] Processing failed:", error);
-		return {
-			candidateCount: candidates.length,
-			claimedCount: 1,
-			outcome: terminal ? "failed" : "retry"
-		};
-	}
-}
-async function processClaimedDeletion(db, claim) {
-	if (claim.phase === "fence" || claim.phase === "registry" || claim.phase === "table") {
-		await deleteActivatedMediaUsageCollection(db, {
-			collectionId: claim.collectionId,
-			collectionSlug: claim.collectionSlug,
-			forceDelete: claim.forceDelete
-		}, {
-			frontPhaseLimit: 1,
-			claimed: claim
-		});
-		return {
-			finalized: false,
-			released: true
-		};
-	}
-	if (claim.phase === "work") await processWorkBatch(db, claim);
-	if (claim.phase === "sources") await processSourceBatch(db, claim);
-	if (claim.phase === "status") await processStatus(db, claim);
-	if (claim.phase === "finalize") {
-		await finalizeDeletion(db, claim);
-		return {
-			finalized: true,
-			released: true
-		};
-	}
-	return {
-		finalized: false,
-		released: false
-	};
-}
-async function processWorkBatch(db, claim) {
-	await withTransaction(db, async (trx) => {
-		const rows = await trx.selectFrom("_emdash_media_usage_work").select("content_id").where("collection_id", "=", claim.collectionId).$if(claim.workCursor !== null, (query) => query.where("content_id", ">", claim.workCursor)).orderBy("content_id", "asc").limit(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch + 1).execute();
-		const batch = rows.slice(0, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch);
-		if (batch.length > 0) await trx.deleteFrom("_emdash_media_usage_work").where("collection_id", "=", claim.collectionId).where("content_id", "in", batch.map((row) => row.content_id)).where(liveLeaseGuard(trx, claim)).execute();
-		await updateDeletion(trx, claim, {
-			phase: rows.length > MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch ? "work" : "sources",
-			work_cursor: rows.length > MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch ? batch.at(-1).content_id : null
-		});
-	});
-	return false;
-}
-async function processSourceBatch(db, claim) {
-	await withTransaction(db, async (trx) => {
-		let sourceKey = claim.sourceKey;
-		if (!sourceKey) {
-			const source = await trx.selectFrom("_emdash_media_usage_sources").select("source_key").where("source_type", "=", "content").where("collection_id", "=", claim.collectionId).orderBy("source_key", "asc").limit(1).executeTakeFirst();
-			if (!source) {
-				await updateDeletion(trx, claim, {
-					phase: "status",
-					source_key: null,
-					occurrence_cursor: null
-				});
-				return;
-			}
-			sourceKey = source.source_key;
-			await updateDeletion(trx, claim, {
-				source_key: sourceKey,
-				occurrence_cursor: null
-			});
-		}
-		const occurrences = await trx.selectFrom("_emdash_media_usage").select("id").where("source_key", "=", sourceKey).$if(claim.occurrenceCursor !== null, (query) => query.where("id", ">", claim.occurrenceCursor)).orderBy("id", "asc").limit(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch + 1).execute();
-		const batch = occurrences.slice(0, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch);
-		if (batch.length > 0) await trx.deleteFrom("_emdash_media_usage").where("source_key", "=", sourceKey).where("id", "in", batch.map((row) => row.id)).where(liveLeaseGuard(trx, claim)).execute();
-		if (occurrences.length > MEDIA_USAGE_COLLECTION_DELETION_LIMITS.rowsPerBatch) {
-			await updateDeletion(trx, claim, {
-				source_key: sourceKey,
-				occurrence_cursor: batch.at(-1).id
-			});
-			return;
-		}
-		await trx.deleteFrom("_emdash_media_usage_sources").where("source_key", "=", sourceKey).where("source_type", "=", "content").where("collection_id", "=", claim.collectionId).where(liveLeaseGuard(trx, claim)).execute();
-		await updateDeletion(trx, claim, {
-			source_key: null,
-			occurrence_cursor: null
-		});
-	});
-	return false;
-}
-async function processStatus(db, claim) {
-	await withTransaction(db, async (trx) => {
-		if (await exactCleanupRowsRemain(trx, claim, false)) throw new Error("Collection deletion cleanup is incomplete");
-		await trx.deleteFrom("_emdash_media_usage_reconciliations").where("collection_id", "=", claim.collectionId).where("collection_slug", "=", claim.collectionSlug).where(liveLeaseGuard(trx, claim)).execute();
-		await trx.deleteFrom("_emdash_media_usage_index_status").where("adapter_id", "=", "content-media").where("scope_type", "=", "collection").where("scope_key", "=", claim.collectionSlug).where("collection_id", "=", claim.collectionId).where(liveLeaseGuard(trx, claim)).execute();
-		await updateDeletion(trx, claim, { phase: "finalize" });
-	});
-	return false;
-}
-async function finalizeDeletion(db, claim) {
-	if (await tableExists(db, `ec_${claim.collectionSlug}`)) throw new Error("Collection table still exists during deletion finalization");
-	if (await exactCleanupRowsRemain(db, claim)) throw new Error("Collection deletion is incomplete");
-	if (await db.selectFrom("_emdash_collections").select("id").where("id", "=", claim.collectionId).where("slug", "=", claim.collectionSlug).executeTakeFirst()) throw new Error("Collection registry identity still exists");
-	const result = await db.deleteFrom("_emdash_media_usage_collection_deletions").where("collection_id", "=", claim.collectionId).where("collection_slug", "=", claim.collectionSlug).where("state", "=", "leased").where("phase", "=", "finalize").where("lease_token", "=", claim.leaseToken).where(liveLeaseGuard(db, claim)).executeTakeFirst();
-	if (Number(result.numDeletedRows ?? 0) !== 1) throw new Error("Collection deletion lost finalization");
-	return true;
-}
-async function exactCleanupRowsRemain(db, claim, includeStatus = true) {
-	const row = (await sql`
-		SELECT
-			EXISTS (
-				SELECT 1 FROM _emdash_media_usage_work
-				WHERE collection_id = ${claim.collectionId}
-			) AS work_present,
-			EXISTS (
-				SELECT 1 FROM _emdash_media_usage_sources
-				WHERE source_type = 'content' AND collection_id = ${claim.collectionId}
-			) AS source_present,
-			EXISTS (
-				SELECT 1 FROM _emdash_media_usage_index_status
-				WHERE adapter_id = 'content-media'
-					AND scope_type = 'collection'
-					AND scope_key = ${claim.collectionSlug}
-					AND collection_id = ${claim.collectionId}
-			) AS status_present
-	`.execute(db)).rows[0];
-	return Boolean(row?.work_present) || Boolean(row?.source_present) || includeStatus && Boolean(row?.status_present);
-}
-async function updateDeletion(db, claim, values) {
-	const result = await db.updateTable("_emdash_media_usage_collection_deletions").set({
-		...values,
-		attempt_count: 0,
-		last_error_code: null,
-		updated_at: collectionDeletionCurrentTimestamp(db)
-	}).where("collection_id", "=", claim.collectionId).where("state", "=", "leased").where("lease_token", "=", claim.leaseToken).where(liveLeaseGuard(db, claim)).executeTakeFirst();
-	if (Number(result.numUpdatedRows ?? 0) !== 1) throw new Error("Collection deletion lease was lost");
-}
-function liveLeaseGuard(db, claim) {
-	return isPostgres(db) ? sql`EXISTS (
-			SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
-			WHERE deletion.collection_id = ${claim.collectionId}
-				AND deletion.state = 'leased'
-				AND deletion.lease_token = ${claim.leaseToken}
-				AND deletion.lease_expires_at::timestamptz > clock_timestamp()
-		)` : sql`EXISTS (
-			SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
-			WHERE deletion.collection_id = ${claim.collectionId}
-				AND deletion.state = 'leased'
-				AND deletion.lease_token = ${claim.leaseToken}
-				AND deletion.lease_expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-		)`;
-}
-function retryDelaySeconds$2(attemptCount) {
-	return Math.min(MEDIA_USAGE_COLLECTION_DELETION_LIMITS.retryMaxSeconds, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.retryBaseSeconds * 2 ** attemptCount);
-}
-
-//#endregion
-//#region src/media/usage/reconciliation.ts
-const ACTIVATION_KEY = "incremental_capture";
-const CONTENT_ADAPTER_ID = "content-media";
-const COLLECTION_SCOPE = "collection";
-const MAX_CANDIDATES = 100;
-const MAX_PORTABLE_DURATION_SECONDS = 365 * 24 * 60 * 60;
-const STABLE_ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
-var MediaUsageReconciliationRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	async findByIdentity(collectionId, runToken) {
-		assertIdentity({
-			collectionId,
-			runToken
-		});
-		const row = await this.db.selectFrom("_emdash_media_usage_reconciliations").selectAll().where("collection_id", "=", collectionId).where("run_token", "=", runToken).executeTakeFirst();
-		return row ? rowToRecord(row) : null;
-	}
-	async beginRun(claim) {
-		const now = timestampOffset(this.db, 0);
-		const sameRun = sql`status = 'running' AND cursor = ${claim.runToken}`;
-		return (await this.db.updateTable("_emdash_media_usage_index_status as status").set({
-			status: "running",
-			started_at: sql`CASE WHEN ${sameRun} THEN started_at ELSE ${now} END`,
-			completed_at: null,
-			cursor: claim.runToken,
-			indexed_source_count: 0,
-			failed_source_count: 0,
-			last_error_code: null,
-			change_epoch: sql`CASE WHEN ${sameRun} THEN change_epoch ELSE change_epoch + 1 END`,
-			reconciliation_required: 1,
-			updated_at: now
-		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", claim.collectionId).where("status.scope_key", "=", claim.collectionSlug).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where((eb) => eb.or([eb("status.status", "!=", "running"), eb("status.cursor", "=", claim.runToken)])).where(this.liveClaimExists(claim)).returning("change_epoch").executeTakeFirst())?.change_epoch ?? null;
-	}
-	async findScanUpperId(claim) {
-		const tableName = contentTableName(claim.collectionSlug);
-		return (await sql`
-			SELECT content.id
-			FROM ${sql.ref(tableName)} AS content
-			WHERE ${this.liveClaimExistsSql(claim)}
-			ORDER BY content.id DESC
-			LIMIT 1
-		`.execute(this.db)).rows[0]?.id ?? null;
-	}
-	async initializeScan(input) {
-		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			target_epoch: input.targetEpoch,
-			field_fingerprint: input.fieldFingerprint,
-			phase: "scan",
-			scan_cursor: null,
-			scan_upper_id: input.scanUpperId,
-			source_cursor: null,
-			source_upper_key: null,
-			attempt_count: 0,
-			last_error_code: null,
-			updated_at: timestampOffset(this.db, 0)
-		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "is", null).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch)).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async findScanPage(reconciliation, limit) {
-		if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50) throw new Error("Reconciliation scan page limit must be from 1 to 50");
-		if (!reconciliation.leaseToken || reconciliation.targetEpoch === null) return [];
-		const tableName = contentTableName(reconciliation.collectionSlug);
-		const lowerBound = reconciliation.scanCursor ? sql`AND content.id > ${reconciliation.scanCursor}` : sql``;
-		const upperBound = reconciliation.scanUpperId ? sql`AND content.id <= ${reconciliation.scanUpperId}` : sql`AND 1 = 0`;
-		return (await sql`
-			SELECT content.id
-			FROM ${sql.ref(tableName)} AS content
-			WHERE 1 = 1
-				${lowerBound}
-				${upperBound}
-				AND ${this.liveClaimExistsSql(reconciliation)}
-			ORDER BY content.id ASC
-			LIMIT ${limit}
-		`.execute(this.db)).rows.map((row) => row.id);
-	}
-	async checkpointScan(input) {
-		let query = this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			scan_cursor: input.nextCursor,
-			attempt_count: 0,
-			last_error_code: null,
-			updated_at: timestampOffset(this.db, 0)
-		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "scan").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch));
-		query = input.previousCursor ? query.where("reconciliation.scan_cursor", "=", input.previousCursor) : query.where("reconciliation.scan_cursor", "is", null);
-		const result = await query.executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async ownsRun(claim, targetEpoch) {
-		const result = await sql`
-			SELECT ${this.statusOwnsRun(claim, targetEpoch)} AS owned
-		`.execute(this.db);
-		return Boolean(result.rows[0]?.owned);
-	}
-	async restartRun(claim, previousEpoch) {
-		const now = timestampOffset(this.db, 0);
-		const interruptedRestart = sql`status = 'running'
-			AND cursor = ${claim.runToken}
-			AND change_epoch > ${previousEpoch}`;
-		return (await this.db.updateTable("_emdash_media_usage_index_status as status").set({
-			status: "running",
-			started_at: sql`CASE WHEN ${interruptedRestart} THEN started_at ELSE ${now} END`,
-			completed_at: null,
-			cursor: claim.runToken,
-			last_error_code: null,
-			change_epoch: sql`CASE WHEN ${interruptedRestart} THEN change_epoch ELSE change_epoch + 1 END`,
-			reconciliation_required: 1,
-			updated_at: now
-		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", claim.collectionId).where("status.scope_key", "=", claim.collectionSlug).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where((eb) => eb.or([eb("status.status", "!=", "running"), eb("status.cursor", "=", claim.runToken)])).where(this.liveClaimExists(claim)).returning("change_epoch").executeTakeFirst())?.change_epoch ?? null;
-	}
-	async restartScan(input) {
-		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			target_epoch: input.targetEpoch,
-			field_fingerprint: input.fieldFingerprint,
-			phase: "scan",
-			scan_cursor: null,
-			scan_upper_id: input.scanUpperId,
-			source_cursor: null,
-			source_upper_key: null,
-			attempt_count: 0,
-			next_attempt_at: timestampOffset(this.db, 0),
-			last_error_code: null,
-			updated_at: timestampOffset(this.db, 0)
-		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.previousEpoch).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch)).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async findWorkBarrier(collectionId) {
-		if (!collectionId) throw new Error("Reconciliation work barrier requires a collection ID");
-		const failed = await this.db.selectFrom("_emdash_media_usage_work").select("last_error_code").where("collection_id", "=", collectionId).where("state", "=", "failed").orderBy("content_id").limit(1).executeTakeFirst();
-		if (failed) return {
-			state: "failed",
-			errorCode: failed.last_error_code ?? "MEDIA_USAGE_PROCESSING_FAILED"
-		};
-		return await this.db.selectFrom("_emdash_media_usage_work").select("content_id").where("collection_id", "=", collectionId).limit(1).executeTakeFirst() ? { state: "pending" } : { state: "empty" };
-	}
-	async findSourceUpperKey(claim, targetEpoch) {
-		return (await this.db.selectFrom("_emdash_media_usage_sources as source").select("source.source_key").where("source.source_type", "=", "content").where("source.collection_id", "=", claim.collectionId).where("source.identity_version", "=", 1).where(this.liveClaimExists(claim)).where(this.statusOwnsRun(claim, targetEpoch)).orderBy("source.source_key", "desc").limit(1).executeTakeFirst())?.source_key ?? null;
-	}
-	async transitionToSources(input) {
-		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			phase: "sources",
-			source_cursor: null,
-			source_upper_key: input.sourceUpperKey,
-			attempt_count: 0,
-			last_error_code: null,
-			updated_at: timestampOffset(this.db, 0)
-		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.field_fingerprint", "=", input.fieldFingerprint).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "scan").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch)).where((eb) => eb.not(eb.exists(eb.selectFrom("_emdash_media_usage_work as work").select("work.content_id").where("work.collection_id", "=", input.claim.collectionId)))).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async findSourcePage(reconciliation, limit) {
-		if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50) throw new Error("Reconciliation source page limit must be from 1 to 50");
-		if (!reconciliation.leaseToken || reconciliation.targetEpoch === null) return [];
-		let query = this.db.selectFrom("_emdash_media_usage_sources as source").select([
-			"source.source_key",
-			"source.content_id",
-			"source.source_variant"
-		]).where("source.source_type", "=", "content").where("source.collection_id", "=", reconciliation.collectionId).where("source.identity_version", "=", 1).where(this.liveClaimExists(reconciliation)).where(this.statusOwnsRun(reconciliation, reconciliation.targetEpoch));
-		if (reconciliation.sourceCursor) query = query.where("source.source_key", ">", reconciliation.sourceCursor);
-		if (reconciliation.sourceUpperKey) query = query.where("source.source_key", "<=", reconciliation.sourceUpperKey);
-		else query = query.where(sql`1 = 0`);
-		return (await query.orderBy("source.source_key").limit(limit).execute()).map((row) => ({
-			sourceKey: row.source_key,
-			contentId: row.content_id,
-			sourceVariant: row.source_variant
-		}));
-	}
-	async findMissingContentIds(collectionSlug, contentIds) {
-		const unique = [...new Set(contentIds)];
-		if (unique.length === 0) return [];
-		if (unique.length > 50 || unique.some((contentId) => !contentId)) throw new Error("Reconciliation source page has invalid content identity");
-		const tableName = contentTableName(collectionSlug);
-		const existing = await sql`
-			SELECT id FROM ${sql.ref(tableName)} WHERE id IN (${sql.join(unique)})
-		`.execute(this.db);
-		const present = new Set(existing.rows.map((row) => row.id));
-		return unique.filter((contentId) => !present.has(contentId));
-	}
-	async checkpointSources(input) {
-		let query = this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			source_cursor: input.nextCursor,
-			attempt_count: 0,
-			last_error_code: null,
-			updated_at: timestampOffset(this.db, 0)
-		}).where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "sources").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db)).where(this.statusOwnsRun(input.claim, input.targetEpoch));
-		query = input.previousCursor ? query.where("reconciliation.source_cursor", "=", input.previousCursor) : query.where("reconciliation.source_cursor", "is", null);
-		const result = await query.executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async finishFailedCoverage(collectionId, runToken) {
-		assertIdentity({
-			collectionId,
-			runToken
-		});
-		const now = timestampOffset(this.db, 0);
-		const result = await this.db.updateTable("_emdash_media_usage_index_status as status").set({
-			status: sql`CASE WHEN EXISTS (
-					SELECT 1 FROM _emdash_media_usage_sources AS source
-					WHERE source.source_type = 'content'
-						AND source.collection_id = ${collectionId}
-						AND source.identity_version = 1
-					LIMIT 1
-				) THEN 'partial' ELSE 'failed' END`,
-			completed_at: null,
-			cursor: null,
-			last_error_code: sql`CASE WHEN (
-					SELECT reconciliation.last_error_code
-					FROM _emdash_media_usage_reconciliations AS reconciliation
-					WHERE reconciliation.collection_id = ${collectionId}
-						AND reconciliation.run_token = ${runToken}
-				) = 'MEDIA_USAGE_RECONCILIATION_ENTRY_FAILED'
-				THEN COALESCE(
-					(SELECT work.last_error_code
-					 FROM _emdash_media_usage_work AS work
-					 WHERE work.collection_id = ${collectionId} AND work.state = 'failed'
-					 ORDER BY work.content_id LIMIT 1),
-					'MEDIA_USAGE_RECONCILIATION_ENTRY_FAILED'
-				)
-				ELSE (
-					SELECT reconciliation.last_error_code
-					FROM _emdash_media_usage_reconciliations AS reconciliation
-					WHERE reconciliation.collection_id = ${collectionId}
-						AND reconciliation.run_token = ${runToken}
-				) END`,
-			reconciliation_required: 1,
-			updated_at: now
-		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", collectionId).where("status.status", "=", "running").where("status.cursor", "=", runToken).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_reconciliations as reconciliation").select("reconciliation.collection_id").where("reconciliation.collection_id", "=", collectionId).where("reconciliation.run_token", "=", runToken).where("reconciliation.state", "=", "failed"))).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async finalizeCoverage(input) {
-		const now = timestampOffset(this.db, 0);
-		const result = await this.db.updateTable("_emdash_media_usage_index_status as status").set({
-			status: "complete",
-			schema_version: input.schemaVersion,
-			completed_at: now,
-			cursor: null,
-			last_error_code: null,
-			reconciliation_required: 0,
-			updated_at: now
-		}).where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.collection_id", "=", input.claim.collectionId).where("status.scope_key", "=", input.claim.collectionSlug).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where("status.status", "=", "running").where("status.cursor", "=", input.claim.runToken).where("status.change_epoch", "=", input.targetEpoch).where((eb) => eb.not(eb.exists(eb.selectFrom("_emdash_media_usage_work as work").select("work.content_id").where("work.collection_id", "=", input.claim.collectionId)))).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_reconciliations as reconciliation").innerJoin("_emdash_collections as collection", (join) => join.onRef("collection.id", "=", "reconciliation.collection_id").onRef("collection.slug", "=", "reconciliation.collection_slug")).select("reconciliation.collection_id").where("reconciliation.collection_id", "=", input.claim.collectionId).where("reconciliation.run_token", "=", input.claim.runToken).where("reconciliation.target_epoch", "=", input.targetEpoch).where("reconciliation.field_fingerprint", "=", input.fieldFingerprint).where("reconciliation.state", "=", "leased").where("reconciliation.phase", "=", "sources").where("reconciliation.lease_token", "=", input.claim.leaseToken).where(liveLease(this.db, "reconciliation.lease_expires_at")).where((inner) => inner.not(inner.exists(inner.selectFrom("_emdash_media_usage_collection_deletions as deletion").select("deletion.collection_id").where("deletion.collection_id", "=", input.claim.collectionId)))))).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_activation as activation").select("activation.task_key").where("activation.task_key", "=", ACTIVATION_KEY).where("activation.state", "=", "active"))).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async deleteFinalized(claim) {
-		const result = await this.db.deleteFrom("_emdash_media_usage_reconciliations as reconciliation").where("reconciliation.collection_id", "=", claim.collectionId).where("reconciliation.run_token", "=", claim.runToken).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", claim.leaseToken).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_index_status as status").select("status.collection_id").where("status.collection_id", "=", claim.collectionId).where("status.scope_key", "=", claim.collectionSlug).where("status.status", "=", "complete").where("status.reconciliation_required", "=", 0))).executeTakeFirst();
-		return Number(result.numDeletedRows ?? 0) === 1;
-	}
-	async deleteOneObsolete() {
-		return (await sql`
-			DELETE FROM _emdash_media_usage_reconciliations
-			WHERE (collection_id, run_token) IN (
-				SELECT reconciliation.collection_id, reconciliation.run_token
-				FROM _emdash_media_usage_reconciliations AS reconciliation
-				INNER JOIN _emdash_media_usage_index_status AS status
-					ON status.collection_id = reconciliation.collection_id
-					AND status.scope_key = reconciliation.collection_slug
-				WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
-					AND status.scope_type = ${COLLECTION_SCOPE}
-					AND status.reconciliation_required = 0
-				ORDER BY reconciliation.updated_at, reconciliation.collection_id
-				LIMIT 1
-			)
-			RETURNING collection_id
-		`.execute(this.db)).rows.length === 1;
-	}
-	liveClaimExists(claim) {
-		return this.liveClaimExistsSql(claim);
-	}
-	liveClaimExistsSql(claim) {
-		return sql`EXISTS (
-			SELECT 1
-			FROM _emdash_media_usage_reconciliations AS reconciliation
-			INNER JOIN _emdash_collections AS collection
-				ON collection.id = reconciliation.collection_id
-				AND collection.slug = reconciliation.collection_slug
-			WHERE reconciliation.collection_id = ${claim.collectionId}
-				AND reconciliation.collection_slug = ${claim.collectionSlug}
-				AND reconciliation.run_token = ${claim.runToken}
-				AND reconciliation.state = 'leased'
-				AND reconciliation.lease_token = ${claim.leaseToken}
-				AND ${liveLease(this.db, "reconciliation.lease_expires_at")}
-				AND EXISTS (
-					SELECT 1 FROM _emdash_media_usage_activation AS activation
-					WHERE activation.task_key = ${ACTIVATION_KEY}
-						AND activation.state = 'active'
-				)
-				AND NOT EXISTS (
-					SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
-					WHERE deletion.collection_id = reconciliation.collection_id
-				)
-		)`;
-	}
-	statusOwnsRun(claim, targetEpoch) {
-		return sql`EXISTS (
-			SELECT 1 FROM _emdash_media_usage_index_status AS status
-			WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
-				AND status.scope_type = ${COLLECTION_SCOPE}
-				AND status.collection_id = ${claim.collectionId}
-				AND status.scope_key = ${claim.collectionSlug}
-				AND status.capture_state = 'active'
-				AND status.reconciliation_required = 1
-				AND status.status = 'running'
-				AND status.cursor = ${claim.runToken}
-				AND status.change_epoch = ${targetEpoch}
-		)`;
-	}
-	async seedNextCandidate() {
-		const runToken = ulid();
-		const now = timestampOffset(this.db, 0);
-		return (await sql`
-			INSERT INTO _emdash_media_usage_reconciliations (
-				collection_id,
-				collection_slug,
-				run_token,
-				next_attempt_at,
-				updated_at
-			)
-			SELECT status.collection_id, status.scope_key, ${runToken}, ${now}, ${now}
-			FROM _emdash_media_usage_index_status AS status
-			INNER JOIN _emdash_collections AS collection
-				ON collection.id = status.collection_id
-				AND collection.slug = status.scope_key
-			WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
-				AND status.scope_type = ${COLLECTION_SCOPE}
-				AND status.capture_state = 'active'
-				AND status.reconciliation_required = 1
-				AND status.collection_id IS NOT NULL
-				AND EXISTS (
-					SELECT 1 FROM _emdash_media_usage_activation AS activation
-					WHERE activation.task_key = ${ACTIVATION_KEY}
-						AND activation.state = 'active'
-				)
-				AND NOT EXISTS (
-					SELECT 1 FROM _emdash_media_usage_reconciliations AS existing
-					WHERE existing.collection_id = status.collection_id
-				)
-				AND NOT EXISTS (
-					SELECT 1 FROM _emdash_media_usage_collection_deletions AS deletion
-					WHERE deletion.collection_id = status.collection_id
-				)
-			ORDER BY status.collection_id
-			LIMIT 1
-			ON CONFLICT (collection_id) DO NOTHING
-			RETURNING collection_id
-		`.execute(this.db)).rows.length === 1;
-	}
-	async findDue(limit) {
-		assertLimit(limit);
-		const nextAttemptIsDue = timestampIsDue(this.db, "next_attempt_at");
-		return (await sql`
-			WITH pending_candidates AS (
-				SELECT * FROM _emdash_media_usage_reconciliations
-				WHERE state = 'pending' AND ${nextAttemptIsDue}
-				ORDER BY next_attempt_at, updated_at, collection_id
-				LIMIT ${limit}
-			), retry_candidates AS (
-				SELECT * FROM _emdash_media_usage_reconciliations
-				WHERE state = 'retry' AND ${nextAttemptIsDue}
-				ORDER BY next_attempt_at, updated_at, collection_id
-				LIMIT ${limit}
-			), leased_candidates AS (
-				SELECT * FROM _emdash_media_usage_reconciliations
-				WHERE state = 'leased' AND ${timestampIsDue(this.db, "lease_expires_at")}
-				ORDER BY lease_expires_at, updated_at, collection_id
-				LIMIT ${limit}
-			), candidates AS (
-				SELECT * FROM pending_candidates
-				UNION ALL SELECT * FROM retry_candidates
-				UNION ALL SELECT * FROM leased_candidates
-			)
-			SELECT * FROM candidates
-			ORDER BY CASE WHEN state = 'leased' THEN lease_expires_at ELSE next_attempt_at END,
-				updated_at,
-				collection_id
-			LIMIT ${limit}
-		`.execute(this.db)).rows.map(rowToRecord);
-	}
-	async findFailed(limit) {
-		assertLimit(limit);
-		return (await this.db.selectFrom("_emdash_media_usage_reconciliations as reconciliation").innerJoin("_emdash_media_usage_index_status as status", (join) => join.onRef("status.collection_id", "=", "reconciliation.collection_id").onRef("status.scope_key", "=", "reconciliation.collection_slug")).selectAll("reconciliation").where("reconciliation.state", "=", "failed").where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where((eb) => eb.or([
-			eb("status.reconciliation_required", "=", 0),
-			eb.and([eb("status.status", "=", "running"), eb("status.cursor", "=", eb.ref("reconciliation.run_token"))]),
-			eb.and([eb("status.cursor", "is", null), eb("status.change_epoch", ">", eb.ref("reconciliation.target_epoch"))])
-		])).orderBy("reconciliation.updated_at").orderBy("reconciliation.collection_id").limit(limit).execute()).map(rowToRecord);
-	}
-	async claim(input) {
-		assertIdentity(input);
-		assertDuration(input.leaseDurationSeconds, "lease duration");
-		const leaseToken = ulid();
-		const row = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			state: "leased",
-			lease_token: leaseToken,
-			lease_expires_at: timestampOffset(this.db, input.leaseDurationSeconds),
-			updated_at: timestampOffset(this.db, 0)
-		}).where("reconciliation.collection_id", "=", input.collectionId).where("reconciliation.run_token", "=", input.runToken).where((eb) => eb.or([eb.and([eb("reconciliation.state", "in", ["pending", "retry"]), timestampIsDue(this.db, "reconciliation.next_attempt_at")]), eb.and([eb("reconciliation.state", "=", "leased"), timestampIsDue(this.db, "reconciliation.lease_expires_at")])])).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_activation as activation").select("activation.task_key").where("activation.task_key", "=", ACTIVATION_KEY).where("activation.state", "=", "active"))).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_index_status as status").innerJoin("_emdash_collections as collection", (join) => join.onRef("collection.id", "=", "status.collection_id").onRef("collection.slug", "=", "status.scope_key")).select("status.collection_id").whereRef("status.collection_id", "=", "reconciliation.collection_id").whereRef("status.scope_key", "=", "reconciliation.collection_slug").where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1))).where((eb) => eb.not(eb.exists(eb.selectFrom("_emdash_media_usage_collection_deletions as deletion").select("deletion.collection_id").whereRef("deletion.collection_id", "=", "reconciliation.collection_id")))).returningAll().executeTakeFirst();
-		return row ? {
-			...rowToRecord(row),
-			leaseToken
-		} : null;
-	}
-	async release(input) {
-		assertLeaseIdentity(input);
-		assertDuration(input.delaySeconds, "release delay", true);
-		const result = await this.db.updateTable("_emdash_media_usage_reconciliations").set({
-			state: "pending",
-			next_attempt_at: timestampOffset(this.db, input.delaySeconds),
-			lease_token: null,
-			lease_expires_at: null,
-			updated_at: timestampOffset(this.db, 0)
-		}).where("collection_id", "=", input.collectionId).where("run_token", "=", input.runToken).where("state", "=", "leased").where("lease_token", "=", input.leaseToken).where(liveLease(this.db)).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async recordFailure(input) {
-		assertLeaseIdentity(input);
-		if (!STABLE_ERROR_CODE_PATTERN.test(input.errorCode)) throw new Error("Reconciliation failure requires a stable error code");
-		assertDuration(input.retryDelaySeconds, "retry delay", true);
-		const result = await this.db.updateTable("_emdash_media_usage_reconciliations").set({
-			state: input.terminal ? "failed" : sql`CASE WHEN attempt_count >= 4 THEN 'failed' ELSE 'retry' END`,
-			...input.terminal ? { target_epoch: sql`COALESCE(
-								target_epoch,
-								(SELECT status.change_epoch
-								 FROM _emdash_media_usage_index_status AS status
-								 WHERE status.adapter_id = ${CONTENT_ADAPTER_ID}
-									AND status.scope_type = ${COLLECTION_SCOPE}
-									AND status.collection_id = ${input.collectionId}
-									AND status.status = 'running'
-									AND status.cursor = ${input.runToken})
-							)` } : {},
-			attempt_count: sql`attempt_count + 1`,
-			next_attempt_at: timestampOffset(this.db, input.retryDelaySeconds),
-			lease_token: null,
-			lease_expires_at: null,
-			last_error_code: input.errorCode,
-			updated_at: timestampOffset(this.db, 0)
-		}).where("collection_id", "=", input.collectionId).where("run_token", "=", input.runToken).where("state", "=", "leased").where("lease_token", "=", input.leaseToken).where(liveLease(this.db)).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async recordEntryFailure(claim) {
-		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			state: "failed",
-			attempt_count: sql`attempt_count + 1`,
-			next_attempt_at: timestampOffset(this.db, 0),
-			lease_token: null,
-			lease_expires_at: null,
-			last_error_code: "MEDIA_USAGE_RECONCILIATION_ENTRY_FAILED",
-			updated_at: timestampOffset(this.db, 0)
-		}).where("reconciliation.collection_id", "=", claim.collectionId).where("reconciliation.run_token", "=", claim.runToken).where("reconciliation.state", "=", "leased").where("reconciliation.lease_token", "=", claim.leaseToken).where(liveLease(this.db)).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_work as work").select("work.content_id").where("work.collection_id", "=", claim.collectionId).where("work.state", "=", "failed"))).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-	async resetFailedForNewEpoch(observed) {
-		const collectionId = "collection_id" in observed ? observed.collection_id : observed.collectionId;
-		const runToken = "run_token" in observed ? observed.run_token : observed.runToken;
-		const targetEpoch = "target_epoch" in observed ? observed.target_epoch : observed.targetEpoch;
-		if (targetEpoch === null) return false;
-		const now = timestampOffset(this.db, 0);
-		const result = await this.db.updateTable("_emdash_media_usage_reconciliations as reconciliation").set({
-			state: "pending",
-			phase: "scan",
-			target_epoch: null,
-			field_fingerprint: null,
-			scan_cursor: null,
-			scan_upper_id: null,
-			source_cursor: null,
-			source_upper_key: null,
-			attempt_count: 0,
-			next_attempt_at: now,
-			lease_token: null,
-			lease_expires_at: null,
-			last_error_code: null,
-			updated_at: now
-		}).where("reconciliation.collection_id", "=", collectionId).where("reconciliation.run_token", "=", runToken).where("reconciliation.state", "=", "failed").where("reconciliation.target_epoch", "=", targetEpoch).where((eb) => eb.exists(eb.selectFrom("_emdash_media_usage_index_status as status").select("status.collection_id").whereRef("status.collection_id", "=", "reconciliation.collection_id").whereRef("status.scope_key", "=", "reconciliation.collection_slug").where("status.adapter_id", "=", CONTENT_ADAPTER_ID).where("status.scope_type", "=", COLLECTION_SCOPE).where("status.capture_state", "=", "active").where("status.reconciliation_required", "=", 1).where("status.cursor", "is", null).where("status.change_epoch", ">", targetEpoch))).executeTakeFirst();
-		return Number(result.numUpdatedRows ?? 0) === 1;
-	}
-};
-function rowToRecord(row) {
-	if (!isState(row.state) || !isPhase(row.phase) || !Number.isSafeInteger(row.attempt_count)) throw new Error("Invalid media usage reconciliation lifecycle");
-	return {
-		collectionId: row.collection_id,
-		collectionSlug: row.collection_slug,
-		runToken: row.run_token,
-		targetEpoch: row.target_epoch,
-		fieldFingerprint: row.field_fingerprint,
-		state: row.state,
-		phase: row.phase,
-		scanCursor: row.scan_cursor,
-		scanUpperId: row.scan_upper_id,
-		sourceCursor: row.source_cursor,
-		sourceUpperKey: row.source_upper_key,
-		attemptCount: row.attempt_count,
-		nextAttemptAt: row.next_attempt_at,
-		leaseToken: row.lease_token,
-		leaseExpiresAt: row.lease_expires_at,
-		lastErrorCode: row.last_error_code,
-		createdAt: row.created_at,
-		updatedAt: row.updated_at
-	};
-}
-function isState(state) {
-	return state === "pending" || state === "retry" || state === "leased" || state === "failed";
-}
-function isPhase(phase) {
-	return phase === "scan" || phase === "sources";
-}
-function assertLimit(limit) {
-	if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_CANDIDATES) throw new Error("Reconciliation candidate limit must be from 1 to 100");
-}
-function assertIdentity(input) {
-	if (!input.collectionId || !input.runToken) throw new Error("Reconciliation requires an exact collection and run token");
-}
-function assertLeaseIdentity(input) {
-	assertIdentity(input);
-	if (!input.leaseToken) throw new Error("Reconciliation requires a lease token");
-}
-function assertDuration(value, label, allowZero = false) {
-	if (!Number.isSafeInteger(value) || value < (allowZero ? 0 : 1) || value > MAX_PORTABLE_DURATION_SECONDS) throw new Error(`Reconciliation ${label} is outside the portable range`);
-}
-function liveLease(db, column = "lease_expires_at") {
-	const expiry = sql.ref(column);
-	return isPostgres(db) ? sql`${expiry} > to_char(statement_timestamp() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')` : sql`${expiry} > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
-}
-function timestampIsDue(db, column) {
-	const value = sql.ref(column);
-	return isPostgres(db) ? sql`${value} <= to_char(statement_timestamp() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')` : sql`${value} <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
-}
-function timestampOffset(db, offsetSeconds) {
-	if (isPostgres(db)) return sql`to_char(
-			(clock_timestamp() AT TIME ZONE 'UTC') + (${offsetSeconds} * INTERVAL '1 second'),
-			'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
-		)`;
-	return sql`strftime(
-		'%Y-%m-%dT%H:%M:%fZ',
-		'now',
-		${`${offsetSeconds >= 0 ? "+" : ""}${offsetSeconds} seconds`}
-	)`;
-}
-function contentTableName(collectionSlug) {
-	validateIdentifier(collectionSlug, "collection slug");
-	const tableName = `ec_${collectionSlug}`;
-	validateIdentifier(tableName, "content table");
-	return tableName;
-}
-
-//#endregion
-//#region src/media/usage/reconciliation-processor.ts
-const MEDIA_USAGE_RECONCILIATION_LIMITS = Object.freeze({
-	candidatesPerTick: 4,
-	pageSize: 50,
-	leaseDurationSeconds: 60,
-	maxAttempts: 5,
-	retryBaseSeconds: 30,
-	retryMaxSeconds: 900,
-	retryJitterRatio: .25,
-	maxQueriesPerTick: 20
-});
-async function processDueMediaUsageReconciliation(db) {
-	if ((await db.selectFrom("_emdash_media_usage_activation").select("state").where("task_key", "=", "incremental_capture").executeTakeFirst())?.state !== "active") return "inactive";
-	const reconciliation = new MediaUsageReconciliationRepository(db);
-	if (await reconciliation.deleteOneObsolete()) return "completed";
-	const [failed] = await reconciliation.findFailed(1);
-	if (failed) {
-		if (await reconciliation.finishFailedCoverage(failed.collectionId, failed.runToken)) return "failed";
-		if (await reconciliation.resetFailedForNewEpoch(failed)) return "advanced";
-	}
-	await reconciliation.seedNextCandidate();
-	const candidates = await reconciliation.findDue(MEDIA_USAGE_RECONCILIATION_LIMITS.candidatesPerTick);
-	let claim = null;
-	for (const candidate of candidates) {
-		claim = await reconciliation.claim({
-			collectionId: candidate.collectionId,
-			runToken: candidate.runToken,
-			leaseDurationSeconds: MEDIA_USAGE_RECONCILIATION_LIMITS.leaseDurationSeconds
-		});
-		if (claim) break;
-	}
-	if (!claim) return candidates.length === 0 ? "not_due" : "claim_lost";
-	try {
-		return await processClaimedReconciliation(db, claim);
-	} catch (error) {
-		const terminal = claim.attemptCount + 1 >= MEDIA_USAGE_RECONCILIATION_LIMITS.maxAttempts;
-		if (!await reconciliation.recordFailure({
-			collectionId: claim.collectionId,
-			runToken: claim.runToken,
-			leaseToken: claim.leaseToken,
-			errorCode: "MEDIA_USAGE_RECONCILIATION_FAILED",
-			retryDelaySeconds: retryDelaySeconds$1(claim.attemptCount),
-			terminal
-		})) return "claim_lost";
-		if (terminal) await reconciliation.finishFailedCoverage(claim.collectionId, claim.runToken);
-		console.error("[media-usage:reconciliation] Processing failed:", error);
-		return terminal ? "failed" : "retry";
-	}
-}
-async function processClaimedMediaUsageReconciliationScan(db, claim, options = {}) {
-	const reconciliation = new MediaUsageReconciliationRepository(db);
-	let current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken);
-	if (!current || current.leaseToken !== claim.leaseToken || current.phase !== "scan") return "deferred";
-	let fields;
-	let fieldFingerprint;
-	if (current.targetEpoch === null) {
-		const targetEpoch = await reconciliation.beginRun(claim);
-		if (targetEpoch === null) {
-			await reconciliation.release({
-				...claim,
-				delaySeconds: 30
-			});
-			return "deferred";
-		}
-		fields = await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
-		fieldFingerprint = await buildContentMediaUsageFieldFingerprint(fields);
-		const scanUpperId = fields.extractionFields.length === 0 ? null : await reconciliation.findScanUpperId(claim);
-		if (!await reconciliation.initializeScan({
-			claim,
-			targetEpoch,
-			fieldFingerprint,
-			scanUpperId
-		})) return "deferred";
-		current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken);
-		if (!current) return "deferred";
-	} else {
-		fields = await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
-		fieldFingerprint = await buildContentMediaUsageFieldFingerprint(fields);
-	}
-	if (current.fieldFingerprint !== fieldFingerprint || current.targetEpoch === null) return "restart_required";
-	const contentIds = await reconciliation.findScanPage(current, 50);
-	if (contentIds.length === 0) {
-		if (options.releaseOnExhausted ?? true) await reconciliation.release({
-			...claim,
-			delaySeconds: 30
-		});
-		return "exhausted";
-	}
-	await new MediaUsageWorkRepository(db).enqueueReconciliationPage({
-		collectionId: claim.collectionId,
-		collectionSlug: claim.collectionSlug,
-		runToken: claim.runToken,
-		leaseToken: claim.leaseToken,
-		changeEpoch: current.targetEpoch,
-		phase: "scan",
-		contentIds
-	});
-	const nextCursor = contentIds.at(-1);
-	if (!await reconciliation.checkpointScan({
-		claim,
-		targetEpoch: current.targetEpoch,
-		previousCursor: current.scanCursor,
-		nextCursor
-	})) return "deferred";
-	if (!await reconciliation.release({
-		...claim,
-		delaySeconds: 0
-	})) return "deferred";
-	return "advanced";
-}
-async function processClaimedReconciliation(db, claim) {
-	const reconciliation = new MediaUsageReconciliationRepository(db);
-	let current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken);
-	if (!current || current.leaseToken !== claim.leaseToken) return "claim_lost";
-	if (current.targetEpoch !== null && !await reconciliation.ownsRun(claim, current.targetEpoch)) return restartReconciliation(db, reconciliation, claim, current);
-	if (current.phase === "scan") {
-		const outcome = await processClaimedMediaUsageReconciliationScan(db, claim, { releaseOnExhausted: false });
-		if (outcome === "restart_required") {
-			current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken) ?? current;
-			return restartReconciliation(db, reconciliation, claim, current);
-		}
-		if (outcome !== "exhausted") return outcome;
-		current = await reconciliation.findByIdentity(claim.collectionId, claim.runToken) ?? current;
-		const barrier = await reconciliation.findWorkBarrier(claim.collectionId);
-		if (barrier.state === "failed") return failReconciliation(reconciliation, claim, barrier.errorCode, true);
-		if (barrier.state === "pending") {
-			await reconciliation.release({
-				...claim,
-				delaySeconds: 30
-			});
-			return "deferred";
-		}
-		if (current.targetEpoch === null || current.fieldFingerprint === null) return "claim_lost";
-		const sourceUpperKey = await reconciliation.findSourceUpperKey(claim, current.targetEpoch);
-		if (!await reconciliation.transitionToSources({
-			claim,
-			targetEpoch: current.targetEpoch,
-			fieldFingerprint: current.fieldFingerprint,
-			sourceUpperKey
-		})) return "claim_lost";
-		if (!await reconciliation.release({
-			...claim,
-			delaySeconds: 0
-		})) return "claim_lost";
-		return "advanced";
-	}
-	return processSourcePhase(db, reconciliation, claim, current);
-}
-async function processSourcePhase(db, reconciliation, claim, current) {
-	if (current.targetEpoch === null || current.fieldFingerprint === null) return "claim_lost";
-	const fields = await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
-	const fieldFingerprint = await buildContentMediaUsageFieldFingerprint(fields);
-	if (fieldFingerprint !== current.fieldFingerprint) return restartReconciliation(db, reconciliation, claim, current, fields, fieldFingerprint);
-	const page = await reconciliation.findSourcePage(current, MEDIA_USAGE_RECONCILIATION_LIMITS.pageSize);
-	if (page.length > 0) {
-		if (page.some((source) => !source.contentId || source.sourceVariant !== "columns" && source.sourceVariant !== "draft_overlay")) return failReconciliation(reconciliation, claim, "MEDIA_USAGE_RECONCILIATION_INVALID_SOURCE", false);
-		const contentIds = [...new Set(page.map((source) => source.contentId))];
-		const enqueueIds = fields.extractionFields.length === 0 ? contentIds : await reconciliation.findMissingContentIds(claim.collectionSlug, contentIds);
-		if (enqueueIds.length > 0) await new MediaUsageWorkRepository(db).enqueueReconciliationPage({
-			collectionId: claim.collectionId,
-			collectionSlug: claim.collectionSlug,
-			runToken: claim.runToken,
-			leaseToken: claim.leaseToken,
-			changeEpoch: current.targetEpoch,
-			phase: "sources",
-			contentIds: enqueueIds
-		});
-		if (!await reconciliation.checkpointSources({
-			claim,
-			targetEpoch: current.targetEpoch,
-			previousCursor: current.sourceCursor,
-			nextCursor: page.at(-1).sourceKey
-		})) return "claim_lost";
-		if (!await reconciliation.release({
-			...claim,
-			delaySeconds: 0
-		})) return "claim_lost";
-		return "advanced";
-	}
-	const barrier = await reconciliation.findWorkBarrier(claim.collectionId);
-	if (barrier.state === "failed") return failReconciliation(reconciliation, claim, barrier.errorCode, true);
-	if (barrier.state === "pending") {
-		await reconciliation.release({
-			...claim,
-			delaySeconds: 30
-		});
-		return "deferred";
-	}
-	if (!await reconciliation.finalizeCoverage({
-		claim,
-		targetEpoch: current.targetEpoch,
-		fieldFingerprint,
-		schemaVersion: CONTENT_SOURCE_SCHEMA_VERSION
-	})) return "claim_lost";
-	if (!await reconciliation.deleteFinalized(claim)) return "claim_lost";
-	return "completed";
-}
-async function restartReconciliation(db, reconciliation, claim, current, fields, fieldFingerprint) {
-	if (current.targetEpoch === null) return "claim_lost";
-	const discoveredFields = fields ?? await loadContentMediaUsageFields(db, claim.collectionSlug, claim.collectionId);
-	const fingerprint = fieldFingerprint ?? await buildContentMediaUsageFieldFingerprint(discoveredFields);
-	const targetEpoch = await reconciliation.restartRun(claim, current.targetEpoch);
-	if (targetEpoch === null) {
-		await reconciliation.release({
-			...claim,
-			delaySeconds: 30
-		});
-		return "deferred";
-	}
-	const scanUpperId = discoveredFields.extractionFields.length === 0 ? null : await reconciliation.findScanUpperId(claim);
-	if (!await reconciliation.restartScan({
-		claim,
-		previousEpoch: current.targetEpoch,
-		targetEpoch,
-		fieldFingerprint: fingerprint,
-		scanUpperId
-	})) return "claim_lost";
-	if (!await reconciliation.release({
-		...claim,
-		delaySeconds: 0
-	})) return "claim_lost";
-	return "advanced";
-}
-async function failReconciliation(reconciliation, claim, errorCode, entryFailure) {
-	if (!(entryFailure ? await reconciliation.recordEntryFailure(claim) : await reconciliation.recordFailure({
-		collectionId: claim.collectionId,
-		runToken: claim.runToken,
-		leaseToken: claim.leaseToken,
-		errorCode,
-		retryDelaySeconds: 0,
-		terminal: true
-	}))) return "claim_lost";
-	await reconciliation.finishFailedCoverage(claim.collectionId, claim.runToken);
-	return "failed";
-}
-function retryDelaySeconds$1(attemptCount) {
-	const exponential = Math.min(MEDIA_USAGE_RECONCILIATION_LIMITS.retryMaxSeconds, MEDIA_USAGE_RECONCILIATION_LIMITS.retryBaseSeconds * 2 ** attemptCount);
-	const jitter = Math.floor(exponential * MEDIA_USAGE_RECONCILIATION_LIMITS.retryJitterRatio * Math.random());
-	return Math.min(MEDIA_USAGE_RECONCILIATION_LIMITS.retryMaxSeconds, exponential + jitter);
-}
-
-//#endregion
-//#region src/media/usage/work-processor.ts
-const MEDIA_USAGE_WORK_PROCESSING_LIMITS = Object.freeze({
-	candidatesPerTick: 4,
-	jobsPerTick: 1,
-	maxTickDurationMs: 5e3,
-	leaseDurationSeconds: 60,
-	maxAttempts: 5,
-	retryBaseSeconds: 30,
-	retryMaxSeconds: 900,
-	retryJitterRatio: .25,
-	ordinaryStatementsPerJob: 20
-});
-async function processMediaUsageWorkAfterWrite(db, collectionSlug, contentId) {
-	if (!await isIncrementalCaptureActive(db)) return {
-		outcome: "inactive",
-		claimed: false
-	};
-	const repo = new MediaUsageWorkRepository(db);
-	const work = await repo.findWorkForContent(collectionSlug, contentId);
-	if (!work) return {
-		outcome: "not_due",
-		claimed: false
-	};
-	return processCandidate(db, repo, work);
-}
-async function processDueMediaUsageWork(db) {
-	const startedAt = Date.now();
-	const result = {
-		candidateCount: 0,
-		claimedCount: 0,
-		completedCount: 0,
-		retryCount: 0,
-		failedCount: 0,
-		supersededCount: 0,
-		obsoleteCount: 0,
-		durationMs: 0,
-		admissionClosed: false
-	};
-	if (!await isIncrementalCaptureActive(db)) {
-		result.durationMs = Date.now() - startedAt;
-		return result;
-	}
-	const repo = new MediaUsageWorkRepository(db);
-	const candidates = await repo.findDueWork(MEDIA_USAGE_WORK_PROCESSING_LIMITS.candidatesPerTick);
-	result.candidateCount = candidates.length;
-	for (const candidate of candidates) {
-		if (result.claimedCount >= MEDIA_USAGE_WORK_PROCESSING_LIMITS.jobsPerTick || Date.now() - startedAt >= MEDIA_USAGE_WORK_PROCESSING_LIMITS.maxTickDurationMs) {
-			result.admissionClosed = true;
-			break;
-		}
-		const processed = await processCandidate(db, repo, candidate);
-		if (processed.claimed) result.claimedCount++;
-		if (processed.outcome === "completed") result.completedCount++;
-		if (processed.outcome === "retry") result.retryCount++;
-		if (processed.outcome === "failed") result.failedCount++;
-		if (processed.outcome === "superseded") result.supersededCount++;
-		if (processed.outcome === "obsolete") result.obsoleteCount++;
-	}
-	result.durationMs = Date.now() - startedAt;
-	return result;
-}
-async function processCandidate(db, repo, candidate) {
-	const claimed = await repo.claimWork({
-		collectionId: candidate.collectionId,
-		contentId: candidate.contentId,
-		workVersion: candidate.workVersion,
-		leaseDurationSeconds: MEDIA_USAGE_WORK_PROCESSING_LIMITS.leaseDurationSeconds
-	});
-	if (!claimed?.leaseToken) return {
-		outcome: "claim_lost",
-		claimed: false
-	};
-	const lease = {
-		collectionId: claimed.collectionId,
-		contentId: claimed.contentId,
-		workVersion: claimed.workVersion,
-		leaseToken: claimed.leaseToken
-	};
-	if (!await collectionIdentityIsCurrent(db, claimed.collectionId, claimed.collectionSlug)) return {
-		outcome: await repo.completeWork(lease) ? "obsolete" : "superseded",
-		claimed: true
-	};
-	const refresh = await refreshContentMediaUsageForWork(db, claimed.collectionId, claimed.collectionSlug, claimed.contentId);
-	if (refresh.success) {
-		const completed = await repo.completeWork(lease);
-		if (completed) await new MediaUsageRepository(db).recordIncrementalSuccess({
-			collectionId: claimed.collectionId,
-			collectionSlug: claimed.collectionSlug
-		});
-		return {
-			outcome: completed ? "completed" : "superseded",
-			claimed: true
-		};
-	}
-	if (!await collectionIdentityIsCurrent(db, claimed.collectionId, claimed.collectionSlug)) return {
-		outcome: await repo.completeWork(lease) ? "obsolete" : "superseded",
-		claimed: true
-	};
-	const errorCode = processingErrorCode(refresh.errorCode);
-	if (errorCode === "MEDIA_USAGE_RESOURCE_LIMIT" || claimed.attemptCount + 1 >= MEDIA_USAGE_WORK_PROCESSING_LIMITS.maxAttempts) {
-		const failed = await repo.failWork({
-			...lease,
-			errorCode
-		});
-		if (failed) await new MediaUsageRepository(db).recordIncrementalFailure({
-			collectionId: claimed.collectionId,
-			collectionSlug: claimed.collectionSlug,
-			contentId: claimed.contentId,
-			workVersion: claimed.workVersion,
-			errorCode
-		});
-		return {
-			outcome: failed ? "failed" : "superseded",
-			claimed: true
-		};
-	}
-	return {
-		outcome: await repo.retryWork({
-			...lease,
-			errorCode,
-			retryDelaySeconds: retryDelaySeconds(claimed.attemptCount)
-		}) ? "retry" : "superseded",
-		claimed: true
-	};
-}
-async function isIncrementalCaptureActive(db) {
-	return (await db.selectFrom("_emdash_media_usage_activation").select("state").where("task_key", "=", "incremental_capture").executeTakeFirst())?.state === "active";
-}
-async function collectionIdentityIsCurrent(db, collectionId, collectionSlug) {
-	return await db.selectFrom("_emdash_collections").select("id").where("id", "=", collectionId).where("slug", "=", collectionSlug).executeTakeFirst() !== void 0;
-}
-function retryDelaySeconds(attemptCount) {
-	const exponential = Math.min(MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryMaxSeconds, MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryBaseSeconds * 2 ** attemptCount);
-	const jitter = Math.floor(exponential * MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryJitterRatio * Math.random());
-	return Math.min(MEDIA_USAGE_WORK_PROCESSING_LIMITS.retryMaxSeconds, exponential + jitter);
-}
-function processingErrorCode(errorCode) {
-	if (errorCode === "DRAFT_REVISION_NOT_FOUND" || errorCode === "DRAFT_REVISION_MISMATCH" || errorCode === "DRAFT_REVISION_INVALID") return "MEDIA_USAGE_SNAPSHOT_FAILED";
-	if (errorCode === "CONTENT_USAGE_GENERATION_CONFLICT") return "MEDIA_USAGE_GENERATION_CONFLICT";
-	if (errorCode === "CONTENT_USAGE_RESOURCE_LIMIT") return "MEDIA_USAGE_RESOURCE_LIMIT";
-	return "MEDIA_USAGE_PROCESSING_FAILED";
-}
-
 //#endregion
 //#region src/plugins/sandbox/runner-options.ts
 /**
@@ -1823,6 +690,28 @@ const LIST_COLUMN_FIELD_TYPES = new Set([
 	"multiSelect"
 ]);
 /**
+* A `ContentSaveRejectedError` carries a message the plugin wrote for the
+* editor; every other exception stays internal and is replaced by a generic
+* message so hook internals cannot leak through the API.
+*/
+function beforeSaveFailure(error) {
+	if (isContentSaveRejection(error)) return {
+		success: false,
+		error: {
+			code: ErrorCode.SAVE_REJECTED,
+			message: error.message
+		}
+	};
+	console.error("EmDash: content:beforeSave hook failed:", error);
+	return {
+		success: false,
+		error: {
+			code: ErrorCode.CONTENT_HOOK_ERROR,
+			message: "A plugin hook failed while saving content"
+		}
+	};
+}
+/**
 * Convert a ContentItem to Record<string, unknown> for hook consumption.
 * Hooks receive the full item as a flat record.
 */
@@ -1905,49 +794,6 @@ const marketplaceManifestCache = /* @__PURE__ */ new Map();
 /** Route metadata for sandboxed plugins: pluginId -> routeName -> RouteMeta */
 const sandboxedRouteMetaCache = /* @__PURE__ */ new Map();
 let sandboxRunner = null;
-const MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS = Object.freeze({
-	entryWork: MEDIA_USAGE_WORK_PROCESSING_LIMITS.ordinaryStatementsPerJob,
-	collectionDeletion: MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxQueriesPerTick,
-	reconciliation: MEDIA_USAGE_RECONCILIATION_LIMITS.maxQueriesPerTick,
-	maxClassQueries: Math.max(MEDIA_USAGE_WORK_PROCESSING_LIMITS.ordinaryStatementsPerJob, MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxQueriesPerTick, MEDIA_USAGE_RECONCILIATION_LIMITS.maxQueriesPerTick),
-	eventCeiling: 40
-});
-async function runScheduledMediaUsageLane(db) {
-	if ((getRequestContext()?.metrics?.dbCount ?? 0) + 1 + MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS.maxClassQueries > MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS.eventCeiling) return {
-		outcome: "admission_closed",
-		taskClass: null,
-		turn: null
-	};
-	const activation = await db.updateTable("_emdash_media_usage_activation").set({ media_usage_maintenance_turn: sql`(media_usage_maintenance_turn + 1) % 3` }).where("task_key", "=", "incremental_capture").where("state", "=", "active").returning("media_usage_maintenance_turn").executeTakeFirst();
-	if (!activation) return {
-		outcome: "inactive",
-		taskClass: null,
-		turn: null
-	};
-	const turn = activation.media_usage_maintenance_turn;
-	if (turn === 0) {
-		await processDueMediaUsageWork(db);
-		return {
-			outcome: "processed",
-			taskClass: "entry_work",
-			turn
-		};
-	}
-	if (turn === 1) {
-		await processDueMediaUsageCollectionDeletions(db);
-		return {
-			outcome: "processed",
-			taskClass: "collection_deletion",
-			turn
-		};
-	}
-	await processDueMediaUsageReconciliation(db);
-	return {
-		outcome: "processed",
-		taskClass: "reconciliation",
-		turn
-	};
-}
 /**
 * EmDashRuntime - singleton per worker
 */
@@ -2115,9 +961,6 @@ var EmDashRuntime = class EmDashRuntime {
 		await recordSchedulerHeartbeatSafely(this.db);
 		return { published };
 	}
-	async runScheduledMediaUsageTasks() {
-		return runScheduledMediaUsageLane(this.db);
-	}
 	/**
 	* Materialize plugin-declared storage indexes, once per process.
 	*
@@ -2417,7 +1260,7 @@ var EmDashRuntime = class EmDashRuntime {
 				});
 			}
 		};
-		const db = await phase("rt.db", "DB init + migrations", () => EmDashRuntime.getDatabase(deps));
+		const db = await phase("rt.db", "DB init + migration policy", () => EmDashRuntime.getDatabase(deps));
 		const resolveDb = () => {
 			return getRequestContext()?.db ?? db;
 		};
@@ -2436,6 +1279,14 @@ var EmDashRuntime = class EmDashRuntime {
 		const ownsConfiguredDb = !!deps.config.database && !(reqCtx?.dbIsIsolated && reqCtx.db);
 		let readDb = db;
 		let readDbDisposable;
+		const disposeReadDb = async () => {
+			const disposable = readDbDisposable;
+			readDbDisposable = void 0;
+			if (!disposable) return;
+			try {
+				await disposable.destroy();
+			} catch {}
+		};
 		if (ownsConfiguredDb && deps.createCoalescingDialect && deps.config.database) try {
 			const dialect = deps.createCoalescingDialect(deps.config.database.config);
 			if (dialect) {
@@ -2449,6 +1300,10 @@ var EmDashRuntime = class EmDashRuntime {
 			readDb = db;
 		}
 		const optionsRepo = new OptionsRepository(readDb);
+		let missingManualSchemaError;
+		const captureMissingManualSchema = (error) => {
+			if ((deps.migrationMode ?? "auto") === "manual" && isMissingTableError(error)) missingManualSchemaError ??= error;
+		};
 		const readSiteInfo = async () => {
 			const siteOpts = await optionsRepo.getMany([
 				"emdash:site_title",
@@ -2468,11 +1323,15 @@ var EmDashRuntime = class EmDashRuntime {
 			try {
 				const states = await readDb.selectFrom("_plugin_state").select(["plugin_id", "status"]).execute();
 				pluginStates = new Map(states.map((s) => [s.plugin_id, s.status]));
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		}), phase("rt.site", "Site info options", async () => {
 			try {
 				siteInfo = await readSiteInfo();
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		})];
 		if (ownsConfiguredDb) coldStartReads.push(phase("rt.seedcheck", "Auto-seed gate", async () => {
 			try {
@@ -2488,21 +1347,33 @@ var EmDashRuntime = class EmDashRuntime {
 					collectionCount: collectionCount.count,
 					setupDone
 				};
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		}));
 		await Promise.all(coldStartReads);
+		if (missingManualSchemaError) {
+			await disposeReadDb();
+			throw missingManualSchemaError;
+		}
 		if (localeCasingRepairVersion && (configuredLocales.some((locale) => locale.includes("-") || locale !== locale.toLowerCase()) || storedLocaleCasingRepairVersion !== void 0) && storedLocaleCasingRepairVersion !== localeCasingRepairVersion) await phase("rt.locale", "Repair locale casing", async () => {
 			await repairLocaleCasing(db, configuredLocales);
 			await new OptionsRepository(db).set(LOCALE_CASING_REPAIR_OPTION, localeCasingRepairVersion);
 		});
 		if (seedGate.collectionCount === 0 && !seedGate.setupDone) {
+			try {
+				if ((await activateMediaUsageCapture(db, { writersDrained: true })).outcome !== "active") throw new Error("Fresh-site media usage activation did not complete");
+			} catch (error) {
+				await disposeReadDb();
+				throw error;
+			}
 			const seedKey = deps.config.database?.entrypoint ?? "default";
 			const seedHolder = getSeedHolder();
 			try {
 				await initWithLock(seedHolder.lock, () => seedHolder.done.has(seedKey) ? true : void 0, async () => {
-					const { applySeed } = await import("../apply-D5zfeD09.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-DmvJrtxS.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-BkqIG_Uj.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-B_VMpJ2P.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-Bo7fZAbg.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-Dd-IUjnZ.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -2519,9 +1390,7 @@ var EmDashRuntime = class EmDashRuntime {
 				} catch {}
 			} catch {}
 		}
-		if (readDbDisposable) try {
-			await readDbDisposable.destroy();
-		} catch {}
+		await disposeReadDb();
 		const enabledPlugins = /* @__PURE__ */ new Set();
 		for (const plugin of deps.plugins) {
 			const status = pluginStates.get(plugin.id);
@@ -2634,11 +1503,6 @@ var EmDashRuntime = class EmDashRuntime {
 				if (deps.createScheduler) {
 					const scheduler = deps.createScheduler(cronExecutor);
 					cronScheduler = scheduler;
-					const runMediaUsageMaintenance = async () => {
-						const runtime = runtimeRef.current;
-						if (runtime) await runtime.runScheduledMediaUsageTasks();
-						else await runScheduledMediaUsageLane(db);
-					};
 					scheduler.setSystemCleanup(async () => {
 						try {
 							const runtime = runtimeRef.current;
@@ -2662,13 +1526,7 @@ var EmDashRuntime = class EmDashRuntime {
 						}
 						await maybeRunScheduledBackup(db, storage ?? void 0);
 						await recordSchedulerHeartbeatSafely(db);
-						if (!scheduler.setMediaUsageMaintenance) try {
-							await runMediaUsageMaintenance();
-						} catch (error) {
-							console.error("[media-usage] Scheduled maintenance failed:", error);
-						}
 					});
-					scheduler.setMediaUsageMaintenance?.(runMediaUsageMaintenance);
 					scheduler.start();
 				}
 			} catch (error) {
@@ -2743,9 +1601,9 @@ var EmDashRuntime = class EmDashRuntime {
 				log: kyselyLogOption()
 			});
 			try {
-				await runMigrations(db);
+				await enforceRuntimeMigrationPolicy(db, deps.migrationMode ?? "auto");
 			} catch (error) {
-				if (!(error instanceof ConcurrentMigrationTimeoutError)) holder.failures.set(cacheKey, {
+				if (!(error instanceof ConcurrentMigrationTimeoutError) && !(error instanceof PendingMigrationsError)) holder.failures.set(cacheKey, {
 					at: Date.now(),
 					message: error instanceof Error ? error.message : String(error)
 				});
@@ -3330,10 +2188,14 @@ var EmDashRuntime = class EmDashRuntime {
 	}
 	async handleContentCreate(collection, body) {
 		let processedData = body.data;
-		if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(body.data, collection, true)).content;
+		if (this.hooks.hasHooks("content:beforeSave")) try {
+			processedData = (await this.hooks.runContentBeforeSave(body.data, collection, true)).content;
+		} catch (error) {
+			return beforeSaveFailure(error);
+		}
 		processedData = await this.runSandboxedBeforeSave(processedData, collection, true);
 		processedData = await this.normalizeMediaFields(collection, processedData);
-		const { validateContentData } = await import("../validation-CiJb_X5o.mjs");
+		const { validateContentData } = await import("../validation-D83n7Npi.mjs");
 		const validation = await validateContentData(this.db, collection, processedData, { partial: false });
 		if (!validation.ok) return {
 			success: false,
@@ -3373,10 +2235,14 @@ var EmDashRuntime = class EmDashRuntime {
 		const { _rev: _discardedRev, ...bodyWithoutRev } = body;
 		let processedData = bodyWithoutRev.data;
 		if (bodyWithoutRev.data) {
-			if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(bodyWithoutRev.data, collection, false)).content;
+			if (this.hooks.hasHooks("content:beforeSave")) try {
+				processedData = (await this.hooks.runContentBeforeSave(bodyWithoutRev.data, collection, false)).content;
+			} catch (error) {
+				return beforeSaveFailure(error);
+			}
 			processedData = await this.runSandboxedBeforeSave(processedData, collection, false);
 			processedData = await this.normalizeMediaFields(collection, processedData);
-			const { validateContentData } = await import("../validation-CiJb_X5o.mjs");
+			const { validateContentData } = await import("../validation-D83n7Npi.mjs");
 			const validation = await validateContentData(this.db, collection, processedData, { partial: true });
 			if (!validation.ok) return {
 				success: false,
@@ -3692,11 +2558,11 @@ var EmDashRuntime = class EmDashRuntime {
 	}
 	async refreshContentUsageAfterSuccessfulWrite(collection, contentIds) {
 		for (const contentId of new Set(contentIds)) try {
-			if ((await processMediaUsageWorkAfterWrite(this.db, collection, contentId)).outcome !== "inactive") return;
+			if ((await processMediaUsageWorkAfterWrite(this.db, collection, contentId)).outcome !== "inactive") continue;
 			await refreshContentMediaUsageAfterWrite(this.db, collection, contentId);
 		} catch (error) {
 			console.error(`[media-usage] Failed after content write ${collection}/${contentId}:`, error);
-			return;
+			continue;
 		}
 	}
 	async deleteContentUsageAfterSuccessfulPermanentDelete(collection, contentId) {
@@ -3917,7 +2783,7 @@ var EmDashRuntime = class EmDashRuntime {
 			const value = result[field.slug];
 			if (value == null) continue;
 			try {
-				const normalized = await normalizeMediaValue(value, getProvider);
+				const normalized = field.type === "image" ? await normalizeImageValue(value, getProvider) : await normalizeMediaValue(value, getProvider);
 				if (normalized) result[field.slug] = normalized;
 			} catch {}
 		}
@@ -3934,7 +2800,7 @@ var EmDashRuntime = class EmDashRuntime {
 					const subValue = normalizedItem[slug];
 					if (subValue == null) continue;
 					try {
-						const normalized = await normalizeMediaValue(subValue, getProvider);
+						const normalized = await normalizeImageValue(subValue, getProvider);
 						if (normalized) normalizedItem[slug] = normalized;
 					} catch {}
 				}
@@ -3960,7 +2826,7 @@ var EmDashRuntime = class EmDashRuntime {
 					result = record;
 				}
 			} catch (error) {
-				console.error(`EmDash: Sandboxed plugin ${id} beforeSave hook error:`, error);
+				console.error(`EmDash: Sandboxed plugin ${id} beforeSave hook threw; a sandboxed plugin cannot cancel a save, so the save continues:`, error);
 			}
 		}
 		return result;
@@ -4193,6 +3059,33 @@ var EmDashRuntime = class EmDashRuntime {
 		return status === void 0 || status === "active";
 	}
 };
+/**
+* Normalize an image field value together with its `darkVariant`. The media
+* normalizer only keeps the media item's own keys, so the variant is normalized
+* separately and reattached.
+*/
+async function normalizeImageValue(value, getProvider) {
+	const primary = await normalizePrimaryImageValue(value, getProvider);
+	if (!primary || !isRecord(value) || value.darkVariant == null) return primary;
+	const darkVariant = await normalizeMediaValue(value.darkVariant, getProvider);
+	return darkVariant ? {
+		...primary,
+		darkVariant
+	} : primary;
+}
+/**
+* Normalize the primary image of an image field value.
+*
+* A legacy string URL that the admin upgraded to `{ id: "", src: url }` so it
+* can carry a dark variant still has to normalize as a string: as an object it
+* counts as local media, which strips `src` and leaves nothing behind. The
+* upgrade outlives the variant — an editor can add one and remove it again —
+* so the shape decides, not the presence of `darkVariant`.
+*/
+async function normalizePrimaryImageValue(value, getProvider) {
+	if (isRecord(value) && !value.id && typeof value.src === "string" && !value.provider) return normalizeMediaValue(value.src, getProvider);
+	return normalizeMediaValue(value, getProvider);
+}
 
 //#endregion
 //#region src/media/url.ts
@@ -4234,6 +3127,21 @@ function createPublicMediaUrlResolver(storage) {
 * middleware.ts.
 */
 const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
+/**
+* Whether the request ended authenticated, for the db adapter's `commit()`.
+* `isAuthenticated` is captured before the route runs, so it misses
+* login/signup/invite requests that create the Astro session mid-request;
+* `session.set()` writes the `astro-session` cookie into the jar synchronously,
+* so scanning the outgoing cookies detects them. Only outgoing cookies count —
+* a stale `astro-session` cookie arriving on an anonymous render must not
+* qualify, or its replica-read bookmark would overwrite a fresher one from an
+* earlier authenticated write.
+*/
+function requestEndedAuthenticated(isAuthenticated, cookies) {
+	if (isAuthenticated) return true;
+	for (const header of cookies.headers()) if (header.startsWith("astro-session=")) return true;
+	return false;
+}
 /** Hold the real adapter close behind both response and deferred-task completion. */
 function coordinateScopedDbLifecycle(scoped) {
 	if (!scoped.close) return { lifecycle: scoped };
@@ -4580,10 +3488,11 @@ function getPlugins() {
 /**
 * Build runtime dependencies from virtual modules
 */
-function buildDependencies(config) {
+function buildDependencies(config, migrationMode) {
 	const sandboxModule = virtualSandboxRunnerModule;
 	return {
 		config,
+		migrationMode,
 		plugins: getPlugins(),
 		createDialect,
 		createCoalescingDialect,
@@ -4604,10 +3513,10 @@ function buildDependencies(config) {
 * cached instance) push nothing — callers should treat an empty array
 * as "warm, nothing to report".
 */
-async function getRuntime(config, initTimings) {
+async function getRuntime(config, migrationMode, initTimings) {
 	const holder = getRuntimeHolder();
 	return initWithLock(holder.lock, () => holder.instance, async (isCurrentClaim) => {
-		const deps = buildDependencies(config);
+		const deps = buildDependencies(config, migrationMode);
 		const runtime = await EmDashRuntime.create(deps, initTimings);
 		if (isCurrentClaim()) holder.instance = runtime;
 		else runtime.stopCron().catch((error) => {
@@ -4638,15 +3547,6 @@ async function runScheduledTasks(options = {}) {
 	if (!config) return { published: [] };
 	return runOutsideRequest(config, (runtime) => runtime.runScheduledTasks(options));
 }
-async function runScheduledMediaUsageTasks() {
-	const config = getConfig();
-	if (!config) return {
-		outcome: "inactive",
-		taskClass: null,
-		turn: null
-	};
-	return runOutsideRequest(config, (runtime) => runtime.runScheduledMediaUsageTasks());
-}
 /**
 * Run a callback against the EmDash runtime outside any HTTP request — from a
 * Cloudflare Queue consumer, a `scheduled()` handler, or any other
@@ -4702,7 +3602,8 @@ async function withEmDashRuntime(run) {
 * event scoping return null and keep using the singleton.
 */
 async function runOutsideRequest(config, fn) {
-	if (getRequestContext()) return runOutsideRequestWithRuntime(config, await getRuntime(config), fn);
+	const migrationMode = resolveConfiguredMigrationMode(config);
+	if (getRequestContext()) return runOutsideRequestWithRuntime(config, await getRuntime(config, migrationMode), fn);
 	const deferredTasks = createDeferredTaskTracker(() => {});
 	return runWithContext({
 		editMode: false,
@@ -4711,7 +3612,7 @@ async function runOutsideRequest(config, fn) {
 	}, async () => {
 		return runOutsideRequestWithRuntime(config, await (async () => {
 			try {
-				return await getRuntime(config);
+				return await getRuntime(config, migrationMode);
 			} finally {
 				deferredTasks.settle();
 				await deferredTasks.settled;
@@ -4774,6 +3675,24 @@ const NOOP_COOKIE_JAR = {
 * that path, so the value is never used — it exists to satisfy the contract.
 */
 const CRON_EVENT_URL = new URL("https://cron.emdash.internal/");
+function resolveConfiguredMigrationMode(config) {
+	const processOverride = typeof process !== "undefined" && process.env ? process.env.EMDASH_MIGRATIONS_MODE : void 0;
+	const importMetaOverride = import.meta.env.EMDASH_MIGRATIONS_MODE;
+	return resolveRuntimeMigrationMode(config.migrations, {
+		dev: import.meta.env.DEV,
+		override: processOverride ?? importMetaOverride
+	});
+}
+function pendingMigrationsResponse(error) {
+	console.error("[emdash] database migrations are pending:", error.pending.join(", "));
+	return migrationRequiredResponse();
+}
+function migrationRequiredResponse() {
+	return new Response("Database migrations are required. Apply the deployment migration manifest and retry.", {
+		status: 503,
+		headers: { "Retry-After": "60" }
+	});
+}
 /**
 * Baseline security headers applied to all responses.
 * Admin routes get additional headers (strict CSP) from auth middleware.
@@ -4889,6 +3808,8 @@ const onRequest = defineMiddleware(async (context, next) => {
 	const queryRecorder = isInstrumentationEnabled() ? createRecorder(url.pathname, request.method, request.headers.get("x-perf-phase") ?? "default") : void 0;
 	const metrics = createRequestMetrics(performance.now());
 	const run = async () => {
+		const config = getConfig();
+		const migrationMode = config ? resolveConfiguredMigrationMode(config) : "auto";
 		const isEmDashRoute = url.pathname.startsWith("/_emdash");
 		const isPublicRuntimeRoute = PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
 		const hasEditCookie = cookies.get("emdash-edit-mode")?.value === "true";
@@ -4899,15 +3820,16 @@ const onRequest = defineMiddleware(async (context, next) => {
 		const hasBearerAuth = (request.headers.get("authorization") ?? "").toLowerCase().startsWith("bearer ");
 		const isWrite = request.method !== "GET" && request.method !== "HEAD";
 		const isAuthenticated = !!sessionUser || hasBearerAuth;
+		const endedAuthenticated = () => requestEndedAuthenticated(isAuthenticated, cookies);
 		const canUseCachedBinding = !isAuthenticated && !isWrite && !playgroundDb && !isEmDashRoute && !hasEditCookie && !hasPreviewToken;
 		if (!isEmDashRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
 			if (!sessionUser && !playgroundDb) {
 				const timings = [];
 				const mwStart = performance.now();
-				if (!isSetupVerified() && !context.isPrerendered) {
+				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
-						const { getDb } = await import("../loader-DLBqRiGP.mjs").then((n) => n.c);
+						const { getDb } = await import("../loader-ZsjE4paL.mjs").then((n) => n.c);
 						await (await getDb()).selectFrom("_emdash_migrations").selectAll().limit(1).execute();
 						markSetupVerified();
 					} catch (error) {
@@ -4920,12 +3842,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 						desc: "Setup probe"
 					});
 				}
-				const config = getConfig();
 				if (config) {
 					const initSubTimings = [];
 					const t0 = performance.now();
 					try {
-						const runtime = await getRuntime(config, initSubTimings);
+						const runtime = await getRuntime(config, migrationMode, initSubTimings);
 						markSetupVerified();
 						locals.emdash = {
 							handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
@@ -4935,6 +3856,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 							storage: runtime.storage
 						};
 					} catch (error) {
+						if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+						if (migrationMode === "manual" && isMissingTableError(error)) {
+							console.error("[emdash] database schema is unavailable in manual migration mode:", error);
+							return migrationRequiredResponse();
+						}
 						if (Date.now() - lastRuntimeInitErrorLogAt >= RUNTIME_INIT_ERROR_LOG_INTERVAL_MS) {
 							lastRuntimeInitErrorLogAt = Date.now();
 							console.error("[emdash] runtime init failed (page renders without CMS data):", error);
@@ -4951,6 +3877,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 				const anonScoped = createRequestScopedDb$1({
 					config: config?.database?.config,
 					isAuthenticated,
+					endedAuthenticated,
 					isWrite,
 					canUseCachedBinding,
 					cookies,
@@ -4995,7 +3922,6 @@ const onRequest = defineMiddleware(async (context, next) => {
 				return runAnon();
 			}
 		}
-		const config = getConfig();
 		if (!config) {
 			console.error("EmDash: No configuration found");
 			return finalizeResponse(await next());
@@ -5006,7 +3932,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 			try {
 				const initSubTimings = [];
 				let t0 = performance.now();
-				const runtime = await getRuntime(config, initSubTimings);
+				const runtime = await getRuntime(config, migrationMode, initSubTimings);
 				timings.push({
 					name: "rt",
 					dur: performance.now() - t0,
@@ -5075,12 +4001,18 @@ const onRequest = defineMiddleware(async (context, next) => {
 					setPluginStatus: runtime.setPluginStatus.bind(runtime)
 				};
 			} catch (error) {
+				if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+				if (migrationMode === "manual" && isMissingTableError(error)) {
+					console.error("[emdash] database schema is unavailable in manual migration mode:", error);
+					return migrationRequiredResponse();
+				}
 				console.error("EmDash middleware error:", error);
 			}
 			const lastContentWriteAt = canUseCachedBinding && config?.database?.needsLastContentWriteAt ? await getLastContentWriteAt() : void 0;
 			const scoped = createRequestScopedDb$1({
 				config: config?.database?.config,
 				isAuthenticated,
+				endedAuthenticated,
 				isWrite,
 				canUseCachedBinding,
 				cookies: context.cookies,
@@ -5148,5 +4080,5 @@ const onRequest = defineMiddleware(async (context, next) => {
 });
 
 //#endregion
-export { onRequest as default, onRequest, runScheduledMediaUsageTasks, runScheduledTasks, withEmDashRuntime };
+export { onRequest as default, onRequest, runScheduledTasks, withEmDashRuntime };
 //# sourceMappingURL=middleware.mjs.map