gencow 0.1.245 → 0.1.246

package/lib/deploy-admission-boundary.mjs

@@ -0,0 +1,52 @@
+const DEFAULT_ADMISSION_TIMEOUT_MS = 5 * 60 * 1000;
+
+function pendingResponse({ requestId, appName, resumeCommand = null }) {
+  const response = new Response(
+    JSON.stringify({
+      error: "Deployment admission is still running. The server request was not cancelled.",
+      code: "PLATFORM_DEPLOYMENT_ADMISSION_PENDING",
+      stage: "admission",
+      retryClass: "retryable-infra",
+      userAction: "VIEW_STATUS",
+      requestId,
+      appName,
+      statusCommand: "gencow deploy status",
+      resumeCommand,
+      serverOperationContinues: "UNKNOWN",
+      databaseState: "UNKNOWN",
+      incumbentServing: "UNKNOWN",
+      operationState: "UNKNOWN",
+    }),
+    { status: 503, headers: { "Content-Type": "application/json", "Retry-After": "5" } },
+  );
+  // The caller must surface this state without replaying the same admission
+  // request as a new deployment. Keep this marker private to the in-process
+  // response path; the public body carries the stable diagnostic contract.
+  response.deploymentAdmissionPending = true;
+  return response;
+}
+
+export async function postDeploymentAdmissionWithTimeout({
+  send,
+  requestId = null,
+  appName,
+  resumeCommand = requestId ? `gencow deploy --resume ${requestId}` : null,
+  timeoutMs = DEFAULT_ADMISSION_TIMEOUT_MS,
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+}) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) throw new Error("DEPLOYMENT_ADMISSION_TIMEOUT_INVALID");
+  const controller = new AbortController();
+  let timer;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeoutImpl(() => {
+      resolve(pendingResponse({ requestId, appName, resumeCommand }));
+    }, timeoutMs);
+    timer?.unref?.();
+  });
+  try {
+    return await Promise.race([send({ signal: controller.signal }), deadline]);
+  } finally {
+    if (timer !== undefined) clearTimeoutImpl(timer);
+  }
+}

package/lib/deploy-failure-diagnostic.mjs

@@ -310,6 +310,32 @@ export function renderDeployFailureDiagnosticLines(responseBody, statusText, opt
       Number.isSafeInteger(Number(contract.operationId))
         ? `gencow deploy status --deployment ${contract.operationId}`
         : "gencow deploy status";
+    if (contract.code === "PLATFORM_DEPLOYMENT_ADMISSION_PENDING") {
+      lines.push(
+        `Database state: ${safeText(responseBody.databaseState, 32) ?? "UNKNOWN"}`,
+        `Incumbent serving: ${safeText(responseBody.incumbentServing, 32) ?? "UNKNOWN"}`,
+        `Operation state: ${safeText(responseBody.operationState, 32) ?? "UNKNOWN"}`,
+      );
+      const requestId = safeText(responseBody.requestId, 128);
+      if (requestId && /^[A-Za-z0-9_-]{8,128}$/u.test(requestId)) lines.push(`Request ID: ${requestId}`);
+      lines.push("Server outcome: unknown; inspect the existing request before submitting another deployment.");
+      const resumeCommand = safeText(responseBody.resumeCommand, 240);
+      const resumeMatch = resumeCommand?.match(
+        /^gencow deploy (?:--resume [A-Za-z0-9_-]{8,128}|--static(?: --prod)? --app ([A-Za-z0-9_-]{1,128})(?: --client [A-Za-z0-9_-]{1,128})? --resume [A-Za-z0-9_-]{8,128})$/u,
+      );
+      const resumeToken = resumeCommand?.match(/--resume ([A-Za-z0-9_-]{8,128})$/u)?.[1];
+      const resumeAppName = resumeMatch?.[1];
+      const expectedResumeApp = options.expectedAppName ?? responseBody.appName;
+      if (
+        resumeMatch &&
+        requestId &&
+        resumeToken === requestId &&
+        (!resumeAppName || !expectedResumeApp || resumeAppName === expectedResumeApp)
+      ) {
+        lines.push(`Next command: ${resumeCommand}`);
+        return lines;
+      }
+    }
     lines.push(`Next command: ${selfService?.action.command ?? exactStatusCommand}`);
     if (contract.blockingOperationId && responseBody.retryReadinessReason === "ACTIVE_OWNER" && selfService) {
       lines.push(`Then check retry gate: ${exactStatusCommand}`);

package/lib/deploy-package-runtime.mjs

@@ -20,6 +20,7 @@ import { buildDeployClaimFromArchive } from "./deploy-package-claim.mjs";
 import { renderDeployFailureDiagnosticLines } from "./deploy-failure-diagnostic.mjs";
 import { readJsonObjectResponse } from "./http-response-json.mjs";
 import { pollAcceptedDeploymentOperation } from "./deployment-operation-poll.mjs";
+import { postDeploymentAdmissionWithTimeout } from "./deploy-admission-boundary.mjs";
 import { submitDeploymentWithIdempotentRetry } from "./deployment-admission-retry.mjs";
 import { acquireDeployReceipt, releaseDeployReceipt } from "./deploy-receipt-store.mjs";
 import { CYAN, DIM, RED, RESET, YELLOW, error, info, log, success, warn } from "./output.mjs";
@@ -154,6 +155,7 @@ export function createDeployPackageRuntime({
 } = {}) {
   let migrationProjectConfig = null;
   let preparedDeployCodegenArtifacts = null;
+  let lastDeployOutcome = "idle";
   function cleanupPreparedDeploySource() {
     preparedDeployCodegenArtifacts?.cleanup?.();
     preparedDeployCodegenArtifacts = null;
@@ -596,6 +598,7 @@ export function createDeployPackageRuntime({
     releaseAttemptId = null,
     clientName = null,
   }) {
+    lastDeployOutcome = "pending";
     const cwd = cwdImpl();
     if (deployClaim?.claim?.migrationBundle?.manifestSha256) {
       emitMigrationResponsibilityNotice(warnImpl);
@@ -612,7 +615,7 @@ export function createDeployPackageRuntime({
       : null;
     let activeBundleBuffer = receipt?.bundleBuffer ?? bundleBuffer;
     let activeDeployClaim = receipt?.deployClaim ?? deployClaim;
-    const deployOnce = async (targetAppId) =>
+    const deployOnce = async (targetAppId, signal) =>
       platformFetchImpl(creds, `/platform/apps/${targetAppId}/deploy?env=${envTarget}`, {
         method: "POST",
         headers: {
@@ -633,6 +636,7 @@ export function createDeployPackageRuntime({
             : {}),
         },
         body: activeBundleBuffer,
+        signal,
       });
     const pollAcceptedDeployment = (initialResponse) =>
       pollAcceptedDeploymentOperation({
@@ -643,11 +647,15 @@ export function createDeployPackageRuntime({
         setTimeoutImpl,
       });
     const submitDeployAdmission = () => {
-      // A legacy request without a deploy claim has no stable pre-receipt
-      // identity. Never retry that request automatically.
-      if (!activeDeployClaim) return deployOnce(targetAppId);
       return submitDeploymentWithIdempotentRetry({
-        submit: () => deployOnce(targetAppId),
+        submit: () =>
+          postDeploymentAdmissionWithTimeout({
+            requestId: activeDeployClaim?.claim?.requestId ?? explicitRequestId,
+            appName: targetAppId,
+            send: ({ signal }) => deployOnce(targetAppId, signal),
+        }),
+        retryOnResponse: Boolean(activeDeployClaim),
+        retryOnTransport: Boolean(activeDeployClaim),
         sleepImpl: (ms) => new Promise((resolveDelay) => setTimeoutImpl(resolveDelay, ms)),
       });
     };
@@ -679,6 +687,9 @@ export function createDeployPackageRuntime({
       if (deployRes.status === 202) {
         deployRes = await pollAcceptedDeployment(deployRes);
       }
+    } catch (error) {
+      lastDeployOutcome = "pending";
+      throw error;
     } finally {
       stopSpinner(spinner);
     }
@@ -727,6 +738,7 @@ export function createDeployPackageRuntime({
         errData?.code === "DEPLOY_REQUEST_IN_PROGRESS" ||
         errData?.code === "CONTROL_PLANE_OBSERVATION_INCOMPLETE" ||
         errData?.retryClass === "retryable-infra";
+      lastDeployOutcome = retryableResponse ? "pending" : "failed";
       if (receipt && !retryableResponse) releaseDeployReceipt(receipt);
       const migrationDiagnostic = isActionableMigrationDiagnostic(errData?.diagnostic)
         ? normalizeRetiredMigrationGateDiagnostic(extractActionableMigrationDiagnostic(errData.diagnostic))
@@ -751,6 +763,7 @@ export function createDeployPackageRuntime({
 
     const deployData = await readJsonObjectResponse(deployRes);
     if (!deployData) {
+      lastDeployOutcome = "unknown";
       errorImpl(
         `Deploy failed: no terminal deployment receipt was returned after packaging.\nCode: CLI_DEPLOY_TERMINAL_RECEIPT_MISSING\nStage: controller\nHTTP status: ${deployRes?.status ?? "unknown"}\nNext action: RETRY`,
       );
@@ -758,6 +771,7 @@ export function createDeployPackageRuntime({
       return null;
     }
     emitMigrationAdvisories(deployData?.warnings, warnImpl);
+    lastDeployOutcome = "completed";
     if (receipt) releaseDeployReceipt(receipt);
     const deployElapsed = ((Date.now() - startTime) / 1000).toFixed(1);
     logImpl("");
@@ -816,5 +830,6 @@ export function createDeployPackageRuntime({
     packageDeployProject,
     createCloudAppIfNeeded,
     deployBundleWithRetry,
+    getLastDeployOutcome: () => lastDeployOutcome,
   };
 }

package/lib/deploy-runtime.mjs

@@ -28,10 +28,12 @@ export function parseDeployArgs(deployArgs) {
     isRollback: false,
     region: null,
     requestId: null,
+    resumeRequested: false,
     staticDeploy: false,
     staticDirArg: null,
     unknownArg: null,
   };
+  Object.defineProperty(parsed, "resumeRequested", { value: false, writable: true });
 
   for (let index = 0; index < deployArgs.length; index += 1) {
     const arg = deployArgs[index];
@@ -47,6 +49,7 @@ export function parseDeployArgs(deployArgs) {
         break;
       }
       parsed.requestId = value;
+      if (arg === "--resume") parsed.resumeRequested = true;
       index += 1;
     } else if (arg.startsWith("--request-id=") || arg.startsWith("--resume=")) {
       const value = arg.slice(arg.indexOf("=") + 1);
@@ -55,6 +58,7 @@ export function parseDeployArgs(deployArgs) {
         break;
       }
       parsed.requestId = value;
+      if (arg.startsWith("--resume=")) parsed.resumeRequested = true;
     } else if (arg === "--region") {
       const value = deployArgs[index + 1];
       if (!value || value.startsWith("-")) {
@@ -518,7 +522,7 @@ export function createDeployCommand({
     }
 
     let staticArtifactPreflight = null;
-    if (parsed.staticDeploy) {
+    if (parsed.staticDeploy && !parsed.resumeRequested) {
       try {
         staticArtifactPreflight = preflightStaticDeployArtifactImpl({
           staticDirArg: resolvedStaticDirArg,
@@ -608,7 +612,7 @@ export function createDeployCommand({
       return;
     }
 
-    if (parsed.envTarget === "prod" && appId && !parsed.existingBundleMode) {
+    if (parsed.envTarget === "prod" && appId && !parsed.existingBundleMode && !parsed.resumeRequested) {
       const prodTarget = await ensureProductionDeployTarget({
         appId: rootAppId,
         displayName,
@@ -649,6 +653,7 @@ export function createDeployCommand({
         envTarget: parsed.envTarget,
         forceDeploy: parsed.forceDeploy,
         requestId: parsed.requestId,
+        resumeStaticOnly: parsed.resumeRequested,
         gencowJsonPath,
         hasDetectedBackend,
         selectedClient,

package/lib/deploy-static-fullstack-runtime.mjs

@@ -153,12 +153,16 @@ export async function deployBackendPackage({
       releaseAttemptId: releaseAttempt?.attemptId ?? null,
       clientName,
     });
-    if (!deployed) await markAttemptFailed("deploy", "DEPLOY_FAILED");
+    if (!deployed && !["pending", "unknown"].includes(activePackageRuntime.getLastDeployOutcome?.())) {
+      await markAttemptFailed("deploy", "DEPLOY_FAILED");
+    }
   } catch (caught) {
-    await markAttemptFailed(
-      packageResult ? "deploy" : "package",
-      packageResult ? "DEPLOY_FAILED" : "PACKAGE_FAILED",
-    );
+    if (activePackageRuntime.getLastDeployOutcome?.() !== "pending") {
+      await markAttemptFailed(
+        packageResult ? "deploy" : "package",
+        packageResult ? "DEPLOY_FAILED" : "PACKAGE_FAILED",
+      );
+    }
     throw caught;
   } finally {
     if (packageResult) {
@@ -220,6 +224,7 @@ export async function runStaticDeployFlow({
   envTarget,
   forceDeploy,
   requestId = null,
+  resumeStaticOnly = false,
   gencowJsonPath,
   hasDetectedBackend,
   staticDirArg,
@@ -251,7 +256,7 @@ export async function runStaticDeployFlow({
   const frontendCwd = cwdImpl();
   let activeAppId = appId;
   let artifactPreflight = staticArtifactPreflight;
-  if (!artifactPreflight) {
+  if (!artifactPreflight && !resumeStaticOnly) {
     try {
       artifactPreflight = preflightStaticDeployArtifactImpl({
         staticDirArg,
@@ -265,8 +270,8 @@ export async function runStaticDeployFlow({
       return;
     }
   }
-  const resolvedStaticDir = artifactPreflight?.targetDir;
-  if (!resolvedStaticDir) {
+  const resolvedStaticDir = artifactPreflight?.targetDir ?? staticDirArg;
+  if (!resolvedStaticDir && !resumeStaticOnly) {
     errorImpl("Static files directory not found.");
     infoImpl("Auto-detect order: dist, out, build, .next/out");
     infoImpl("Specify manually: gencow deploy --static <dir>");
@@ -274,7 +279,7 @@ export async function runStaticDeployFlow({
     return;
   }
 
-  const shouldDeployBackend = hasDetectedBackend;
+  const shouldDeployBackend = hasDetectedBackend && !resumeStaticOnly;
   let releaseAttemptId = null;
   if (shouldDeployBackend) {
     logImpl(`\n${BOLD}${CYAN}Gencow Deploy (Fullstack)${RESET}\n`);
@@ -321,8 +326,10 @@ export async function runStaticDeployFlow({
       envTarget,
       forceDeploy,
       hasBackend: shouldDeployBackend,
+      resumeStaticOnly,
       releaseAttemptId,
       releaseSourceRoot: backendRoot,
+      requestId,
     },
   });
 }

package/lib/deployment-admission-retry.mjs

@@ -1,7 +1,10 @@
 const INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS = 3;
 
 function isRetryableInitialDeploymentAdmission(response) {
-  return Number.isInteger(response?.status) && response.status >= 500 && response.status <= 599;
+  return response?.deploymentAdmissionPending !== true
+    && Number.isInteger(response?.status)
+    && response.status >= 500
+    && response.status <= 599;
 }
 
 /**
@@ -12,17 +15,19 @@ function isRetryableInitialDeploymentAdmission(response) {
 export async function submitDeploymentWithIdempotentRetry({
   submit,
   sleepImpl = (ms) => new Promise((resolveDelay) => setTimeout(resolveDelay, ms)),
+  retryOnResponse = true,
+  retryOnTransport = true,
 }) {
   let response;
   for (let attempt = 1; attempt <= INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS; attempt += 1) {
     try {
       response = await submit();
     } catch (error) {
-      if (attempt === INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS) throw error;
+      if (!retryOnTransport || attempt === INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS) throw error;
       await sleepImpl(250 * attempt);
       continue;
     }
-    if (!isRetryableInitialDeploymentAdmission(response) || attempt === INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS) {
+    if (!retryOnResponse || !isRetryableInitialDeploymentAdmission(response) || attempt === INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS) {
       return response;
     }
     await sleepImpl(250 * attempt);

package/lib/static-deploy-command.mjs

@@ -20,6 +20,12 @@ import { getCliInvocationSelection } from "./project-context.mjs";
 import { pollAcceptedDeploymentOperation } from "./deployment-operation-poll.mjs";
 import { renderDeployFailureDiagnosticLines } from "./deploy-failure-diagnostic.mjs";
 import { writeProjectMetadata } from "./deploy-project-metadata.mjs";
+import { postDeploymentAdmissionWithTimeout } from "./deploy-admission-boundary.mjs";
+import {
+  loadStaticDeployReceipt,
+  releaseStaticDeployReceipt,
+  saveStaticDeployReceipt,
+} from "./static-deploy-receipt-store.mjs";
 
 function shouldPreserveFinalizeAttempt(error) {
   return error?.retryable === true || error?.message === "APP_SERVING_ROUTE_COMMIT_PENDING";
@@ -242,23 +248,55 @@ export function createStaticDeployRuntime({
     opts = {},
   }) {
     const cwd = cwdImpl();
+    const receiptContext = {
+      clientName: opts.clientName ?? getCliInvocationSelection()?.client ?? null,
+      sourceRoot: resolvePathImpl(opts.releaseSourceRoot || cwd),
+      metadataPath: resolvePathImpl(gencowJsonPath || resolvePathImpl(cwd, "gencow.json")),
+    };
     const hasBackend = opts.hasBackend === true;
+    let resumedStaticReceipt = null;
+    if (opts.resumeStaticOnly && opts.requestId) {
+      if (!appId) {
+        errorImpl("Static deployment resume requires the original app target.");
+        infoImpl("Code: STATIC_DEPLOY_RECEIPT_SCOPE_REQUIRED");
+        exitImpl(1);
+        return;
+      }
+      try {
+        resumedStaticReceipt = loadStaticDeployReceipt({
+          cwd,
+          requestId: opts.requestId,
+          appId,
+          envTarget: opts.envTarget || "dev",
+          context: receiptContext,
+        });
+      } catch (caught) {
+        const contextMismatch = caught.message === "STATIC_DEPLOY_RECEIPT_CONTEXT_MISMATCH";
+        errorImpl("Static deployment resume could not validate the saved receipt.");
+        infoImpl(`Code: ${contextMismatch ? caught.message : "STATIC_DEPLOY_RECEIPT_UNAVAILABLE"}`);
+        infoImpl("No deployment request sent; saved receipt retained. Retry from the original workspace with the original client selection.");
+        exitImpl(1);
+        return;
+      }
+    }
     let artifactPreflight;
-    try {
-      artifactPreflight = preflightStaticDeployArtifact({
-        staticDirArg,
-        cwd,
-        existsSyncImpl,
-        lstatSyncImpl,
-        readdirSyncImpl,
-        resolvePathImpl,
-      });
-    } catch (manifestError) {
-      errorImpl(manifestError instanceof Error ? manifestError.message : String(manifestError));
-      exitImpl(1);
-      return;
+    if (!resumedStaticReceipt) {
+      try {
+        artifactPreflight = preflightStaticDeployArtifact({
+          staticDirArg,
+          cwd,
+          existsSyncImpl,
+          lstatSyncImpl,
+          readdirSyncImpl,
+          resolvePathImpl,
+        });
+      } catch (manifestError) {
+        errorImpl(manifestError instanceof Error ? manifestError.message : String(manifestError));
+        exitImpl(1);
+        return;
+      }
     }
-    const targetDir = artifactPreflight?.targetDir;
+    const targetDir = artifactPreflight?.targetDir ?? resumedStaticReceipt?.sourceDir;
 
     if (!targetDir) {
       errorImpl("Static files directory not found.");
@@ -273,10 +311,10 @@ export function createStaticDeployRuntime({
     infoImpl(appId ? `App ID: ${appId}` : `App:    new (ID auto-generated)`);
     logImpl("");
 
-    const { artifactManifest } = artifactPreflight;
-    infoImpl(`Artifact:   ${artifactManifest.mode} (${artifactManifest.fileCount} files)`);
+    const artifactManifest = artifactPreflight?.artifactManifest;
+    if (artifactManifest) infoImpl(`Artifact:   ${artifactManifest.mode} (${artifactManifest.fileCount} files)`);
 
-    try {
+    if (!resumedStaticReceipt) try {
       const apiRefFiles = findBuiltApiReferenceFiles({
         targetDir: resolvePathImpl(cwd, targetDir),
         readFileSyncImpl,
@@ -341,8 +379,8 @@ export function createStaticDeployRuntime({
       await new Promise((resolveDelay) => setTimeoutImpl(resolveDelay, 3000));
     }
 
-    let releaseAttemptId = opts.releaseAttemptId || null;
-    if (!releaseAttemptId && prepareReleaseAttemptImpl) {
+    let releaseAttemptId = opts.releaseAttemptId || resumedStaticReceipt?.releaseAttemptId || null;
+    if (!releaseAttemptId && !resumedStaticReceipt && prepareReleaseAttemptImpl) {
       const releaseAttempt = await prepareReleaseAttemptImpl({
         root: opts.releaseSourceRoot || cwd,
         sourceRootKind: "static",
@@ -376,6 +414,15 @@ export function createStaticDeployRuntime({
     const tmpBundle = resolvePathImpl(cwd, ".gencow", "static-bundle.tar.gz");
     mkdirSyncImpl(resolvePathImpl(tmpBundle, ".."), { recursive: true });
 
+    let bundleSize;
+    let bundleBuffer;
+    let deployClaim;
+    if (resumedStaticReceipt) {
+      bundleBuffer = resumedStaticReceipt.bundleBuffer;
+      bundleSize = bundleBuffer.length;
+      deployClaim = resumedStaticReceipt.deployClaim;
+      successImpl(`Resuming exact static bundle: ${(bundleSize / 1024).toFixed(1)} KB`);
+    } else {
     try {
       await createTarGzipArchive({
         cwd: resolvePathImpl(cwd, targetDir),
@@ -390,7 +437,7 @@ export function createStaticDeployRuntime({
       return;
     }
 
-    const bundleSize = statSyncImpl(tmpBundle).size;
+    bundleSize = statSyncImpl(tmpBundle).size;
     if (bundleSize > 100 * 1024 * 1024) {
       await markAttemptFailed("package", "PACKAGE_TOO_LARGE");
       errorImpl(`Bundle too large: ${(bundleSize / (1024 * 1024)).toFixed(1)} MB (max 100 MB)`);
@@ -404,13 +451,13 @@ export function createStaticDeployRuntime({
     }
     successImpl(`Bundle created: ${(bundleSize / 1024).toFixed(1)} KB`);
 
-    const bundleBuffer = readFileSyncImpl(tmpBundle);
-    let deployClaim;
+    bundleBuffer = readFileSyncImpl(tmpBundle);
     try {
       deployClaim = await buildDeployClaimFromArchiveImpl({
         bundleBuffer,
         declaredRuntime: "none",
         cliVersion,
+        ...(opts.requestId ? { requestId: opts.requestId } : {}),
       });
     } catch (caught) {
       await markAttemptFailed("package", "DEPLOY_CONTRACT_FAILED");
@@ -423,6 +470,32 @@ export function createStaticDeployRuntime({
       exitImpl(1);
       return;
     }
+    }
+    let staticReceipt = resumedStaticReceipt;
+    if (!staticReceipt && deployClaim?.claim?.requestId) {
+      try {
+        staticReceipt = saveStaticDeployReceipt({
+          cwd,
+          requestId: deployClaim.claim.requestId,
+          appId,
+          envTarget: opts.envTarget || "dev",
+          sourceDir: targetDir,
+          context: receiptContext,
+          releaseAttemptId,
+          bundleBuffer,
+          deployClaim,
+        });
+      } catch (caught) {
+        if (caught.message === "STATIC_DEPLOY_RECEIPT_IDENTITY_CONFLICT") {
+          errorImpl("Static deploy request ID is already bound to a different bundle or release.");
+          infoImpl("Code: STATIC_DEPLOY_RECEIPT_IDENTITY_CONFLICT");
+          infoImpl("No deployment request sent; use the saved receipt or omit --request-id for a new deployment.");
+          exitImpl(1);
+          return;
+        }
+        throw caught;
+      }
+    }
 
     infoImpl("Deploying static files...");
     let deployRes;
@@ -430,22 +503,31 @@ export function createStaticDeployRuntime({
     try {
       deployRes = await postStaticDeployWithTransientProxyRetry({
         send: () =>
-          platformFetchImpl(creds, `/platform/apps/${appId}/deploy-static`, {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/octet-stream",
-              "X-Deploy-Local-Dir": cwd,
-              "X-Gencow-Deploy-Claim": deployClaim.header,
-              "X-Gencow-Deploy-Protocol": "1",
-              "X-Gencow-CLI-Version": deployClaim.claim.generatedBy.version,
-              ...(releaseAttemptId
-                ? {
-                    "X-Gencow-Release-Attempt-Id": releaseAttemptId,
-                    "X-Gencow-Release-Environment": opts.envTarget || "dev",
-                  }
-                : {}),
-            },
-            body: bundleBuffer,
+          postDeploymentAdmissionWithTimeout({
+            requestId: deployClaim.claim.requestId,
+            appName: appId,
+            // Resume static admission directly; fullstack flow skips the
+            // already-completed backend component for this scoped receipt.
+            resumeCommand: `gencow deploy --static${opts.envTarget === "prod" ? " --prod" : ""} --app ${appId}${opts.clientName ? ` --client ${opts.clientName}` : ""} --resume ${deployClaim.claim.requestId}`,
+            send: ({ signal }) =>
+              platformFetchImpl(creds, `/platform/apps/${appId}/deploy-static`, {
+                method: "POST",
+                headers: {
+                  "Content-Type": "application/octet-stream",
+                  "X-Deploy-Local-Dir": cwd,
+                  "X-Gencow-Deploy-Claim": deployClaim.header,
+                  "X-Gencow-Deploy-Protocol": "1",
+                  "X-Gencow-CLI-Version": deployClaim.claim.generatedBy.version,
+                  ...(releaseAttemptId
+                    ? {
+                        "X-Gencow-Release-Attempt-Id": releaseAttemptId,
+                        "X-Gencow-Release-Environment": opts.envTarget || "dev",
+                      }
+                    : {}),
+                },
+                body: bundleBuffer,
+                signal,
+              }),
           }),
         retryDelaysMs: staticDeployRetryDelaysMs,
         delayImpl: staticDeployRetryDelayImpl,
@@ -510,8 +592,15 @@ export function createStaticDeployRuntime({
         errData.operationId === undefined &&
         errData.deployId === undefined &&
         errData.state === undefined;
-      if (verifiedTerminalFailure || rejectedBeforeOperation)
+      const retryableInfrastructureFailure = errData?.retryClass === "retryable-infra";
+      if ((verifiedTerminalFailure || rejectedBeforeOperation) && !retryableInfrastructureFailure)
         await markAttemptFailed("deploy", "DEPLOY_FAILED");
+      if (
+        staticReceipt &&
+        (verifiedTerminalFailure || rejectedBeforeOperation) &&
+        !retryableInfrastructureFailure
+      )
+        releaseStaticDeployReceipt(staticReceipt);
       const [headline, ...details] = renderDeployFailureDiagnosticLines(errData, deployRes.statusText, {
         expectedAppName: appId,
       });
@@ -540,10 +629,12 @@ export function createStaticDeployRuntime({
       } catch (caught) {
         if (!shouldPreserveFinalizeAttempt(caught)) {
           await markAttemptFailed("finalize", "APP_RELEASE_FINALIZE_FAILED");
+          if (staticReceipt) releaseStaticDeployReceipt(staticReceipt);
         }
         throw caught;
       }
     }
+    if (staticReceipt) releaseStaticDeployReceipt(staticReceipt);
     logImpl("");
     successImpl("Static deploy complete!");
     infoImpl(`App ID: ${appId}`);
@@ -572,15 +663,17 @@ export function createStaticDeployRuntime({
     }
 
     const envSyncRoot = opts.releaseSourceRoot || cwd;
-    const envSyncConfig = loadConfigImpl
+    const envSyncConfig = !opts.resumeStaticOnly && loadConfigImpl
       ? await loadConfigImpl({ cwd: envSyncRoot, processEnv: process.env, throwOnInvalid: false })
       : null;
-    updateEnvLocalUrlImpl(data.url, {
-      config: envSyncConfig,
-      cwd: envSyncRoot,
-      clientName: opts.clientName ?? getCliInvocationSelection()?.client ?? null,
-      projectDir: envSyncRoot,
-    });
+    if (!opts.resumeStaticOnly) {
+      updateEnvLocalUrlImpl(data.url, {
+        config: envSyncConfig,
+        cwd: envSyncRoot,
+        clientName: opts.clientName ?? getCliInvocationSelection()?.client ?? null,
+        projectDir: envSyncRoot,
+      });
+    }
     logImpl("");
     if (!existsSyncImpl(gencowJsonPath)) {
       writeProjectMetadata({

package/lib/static-deploy-receipt-store.mjs

@@ -0,0 +1,100 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/u;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function directoryFor(cwd, requestId) {
+  if (typeof cwd !== "string" || cwd.includes("\0") || !REQUEST_ID_PATTERN.test(requestId)) {
+    throw new Error("STATIC_DEPLOY_RECEIPT_INPUT_INVALID");
+  }
+  return resolve(cwd, ".gencow", "static-deploy-receipts", requestId);
+}
+
+export function saveStaticDeployReceipt({
+  cwd,
+  requestId,
+  appId,
+  envTarget,
+  sourceDir,
+  releaseAttemptId = null,
+  bundleBuffer,
+  deployClaim,
+  context = null,
+}) {
+  const directory = directoryFor(cwd, requestId);
+  const archiveSha256 = Buffer.isBuffer(bundleBuffer) ? sha256(bundleBuffer) : null;
+  if (
+    !Buffer.isBuffer(bundleBuffer) ||
+    deployClaim?.claim?.requestId !== requestId ||
+    deployClaim.claim.sourceBundleSha256 !== archiveSha256
+  ) {
+    throw new Error("STATIC_DEPLOY_RECEIPT_INPUT_INVALID");
+  }
+  mkdirSync(resolve(directory, ".."), { recursive: true, mode: 0o700 });
+  const receipt = {
+    version: 1,
+    component: "static",
+    requestId,
+    appId,
+    envTarget,
+    sourceDir,
+    context,
+    releaseAttemptId,
+    archiveSha256,
+    claim: deployClaim.claim,
+    claimHeader: deployClaim.header,
+  };
+  const temporary = `${directory}.tmp-${process.pid}`;
+  mkdirSync(temporary, { recursive: true, mode: 0o700 });
+  writeFileSync(resolve(temporary, "archive.tar.gz"), bundleBuffer, { mode: 0o600 });
+  writeFileSync(resolve(temporary, "receipt.json"), `${JSON.stringify(receipt, null, 2)}\n`, { mode: 0o600 });
+  try {
+    renameSync(temporary, directory);
+  } catch (error) {
+    rmSync(temporary, { recursive: true, force: true });
+    if (!existsSync(directory)) throw error;
+    const existing = loadStaticDeployReceipt({ cwd, requestId, appId, envTarget, context });
+    if (!existing.bundleBuffer.equals(bundleBuffer) || existing.deployClaim.header !== deployClaim.header ||
+        existing.releaseAttemptId !== releaseAttemptId) throw new Error("STATIC_DEPLOY_RECEIPT_IDENTITY_CONFLICT");
+    return existing;
+  }
+  return { directory, bundleBuffer, deployClaim, releaseAttemptId };
+}
+
+export function loadStaticDeployReceipt({ cwd, requestId, appId, envTarget, context = null }) {
+  const directory = directoryFor(cwd, requestId);
+  const receipt = JSON.parse(readFileSync(resolve(directory, "receipt.json"), "utf8"));
+  const bundleBuffer = readFileSync(resolve(directory, "archive.tar.gz"));
+  if (
+    receipt.version !== 1 || receipt.component !== "static" || receipt.requestId !== requestId || receipt.appId !== appId ||
+    receipt.envTarget !== envTarget || typeof receipt.sourceDir !== "string" ||
+    !SHA256_PATTERN.test(receipt.archiveSha256) ||
+    sha256(bundleBuffer) !== receipt.archiveSha256 ||
+    receipt.claim?.sourceBundleSha256 !== receipt.archiveSha256 ||
+    receipt.claim?.requestId !== requestId ||
+    typeof receipt.claimHeader !== "string"
+  ) throw new Error("STATIC_DEPLOY_RECEIPT_CORRUPT");
+  if (context && receipt.context && (
+      receipt.context.clientName !== context.clientName || receipt.context.sourceRoot !== context.sourceRoot ||
+      receipt.context.metadataPath !== context.metadataPath)) {
+    throw new Error("STATIC_DEPLOY_RECEIPT_CONTEXT_MISMATCH");
+  }
+  return {
+    directory,
+    sourceDir: receipt.sourceDir,
+    bundleBuffer,
+    releaseAttemptId: receipt.releaseAttemptId ?? null,
+    deployClaim: { claim: receipt.claim, header: receipt.claimHeader },
+  };
+}
+
+export function releaseStaticDeployReceipt(receipt) {
+  if (!receipt?.directory) throw new Error("STATIC_DEPLOY_RECEIPT_RELEASE_INVALID");
+  rmSync(receipt.directory, { recursive: true, force: true });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.245",
+  "version": "0.1.246",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {
@@ -38,9 +38,9 @@
     "@types/node": "^25.9.5",
     "better-auth": "^1.6.23",
     "@typescript/native": "npm:typescript@7.0.2",
-    "@gencow/client": "0.2.7",
     "@gencow/react": "0.2.7",
-    "@gencow/core": "0.1.45"
+    "@gencow/core": "0.1.45",
+    "@gencow/client": "0.2.7"
   },
   "scripts": {
     "prebuild": "pnpm --filter @gencow/migration-contract run build && pnpm --filter @gencow/server run build",

package/runtime/server.mjs

@@ -160748,6 +160748,10 @@ var init_server_platform_media_worker_storage_runtime = __esm({
 });
 
 // ../internal/dist/src/platform-scheduled-job-secret.js
+function globalSigningSecretStore() {
+  const globalObject2 = globalThis;
+  return globalObject2[PLATFORM_SIGNING_SECRET_GLOBAL_KEY] ??= {};
+}
 function usableSecret(value) {
   const secret = value?.trim();
   return secret && secret !== DEFAULT_PLATFORM_SECRET ? secret : null;
@@ -160759,17 +160763,38 @@ function capturePlatformScheduledJobSigningSecret(env2 = process.env) {
   if (env2.IS_PLATFORM !== "true")
     return void 0;
   scheduledJobSigningSecretSnapshot = resolveSecret(env2);
+  globalSigningSecretStore().value = scheduledJobSigningSecretSnapshot ?? void 0;
   return scheduledJobSigningSecretSnapshot ?? void 0;
 }
 function getPlatformScheduledJobSigningSecret() {
-  return scheduledJobSigningSecretSnapshot ?? resolveSecret(process.env) ?? void 0;
+  return scheduledJobSigningSecretSnapshot ?? globalSigningSecretStore().value;
+}
+function initializePlatformScheduledJobSigningSecret(secret) {
+  const usable = usableSecret(secret);
+  if (!usable)
+    throw new Error("SCHEDULED_JOB_DELIVERY_SIGNING_SECRET_UNAVAILABLE");
+  const existing = scheduledJobSigningSecretSnapshot ?? globalSigningSecretStore().value;
+  if (existing && existing !== usable) {
+    throw new Error("SCHEDULED_JOB_DELIVERY_SIGNING_SECRET_ALREADY_INITIALIZED");
+  }
+  scheduledJobSigningSecretSnapshot = usable;
+  globalSigningSecretStore().value = usable;
 }
-var DEFAULT_PLATFORM_SECRET, scheduledJobSigningSecretSnapshot;
+async function loadPlatformProvisionerWithScheduledJobSigningSecret(load) {
+  const secret = getPlatformScheduledJobSigningSecret();
+  if (!secret)
+    throw new Error("SCHEDULED_JOB_DELIVERY_SIGNING_SECRET_UNAVAILABLE");
+  const provisioner = await load();
+  provisioner.initializePlatformScheduledJobSigningSecret(secret);
+  return provisioner;
+}
+var DEFAULT_PLATFORM_SECRET, scheduledJobSigningSecretSnapshot, PLATFORM_SIGNING_SECRET_GLOBAL_KEY;
 var init_platform_scheduled_job_secret = __esm({
   "../internal/dist/src/platform-scheduled-job-secret.js"() {
     "use strict";
     DEFAULT_PLATFORM_SECRET = "gencow-default-secret";
     scheduledJobSigningSecretSnapshot = null;
+    PLATFORM_SIGNING_SECRET_GLOBAL_KEY = /* @__PURE__ */ Symbol.for("gencow.platformScheduledJobSigningSecret");
   }
 });
 
@@ -186891,7 +186916,18 @@ async function beginAppNameD1Delete(input) {
           (public.app_name_incarnation_handoffs.state = 'd1_blocked'
            AND public.app_name_incarnation_handoffs.d1_app_id = ${input.appId}
            AND public.app_name_incarnation_handoffs.d1_app_instance_id = ${input.appInstanceId}
-           AND public.app_name_incarnation_handoffs.d1_delete_operation_id = ${input.deleteOperationId})
+           AND (
+             public.app_name_incarnation_handoffs.d1_delete_operation_id = ${input.deleteOperationId}
+             OR EXISTS (
+               SELECT 1
+                FROM public.app_lifecycle_operations prior_delete
+               WHERE prior_delete.id = public.app_name_incarnation_handoffs.d1_delete_operation_id
+                  AND prior_delete.app_id = ${input.appId}
+                  AND prior_delete.app_instance_id = ${input.appInstanceId}
+                  AND prior_delete.app_name = ${input.publicName}
+                  AND prior_delete.state = 'failed_delete_recovery_required'
+             )
+           ))
         )
     RETURNING id
   `);
@@ -191890,6 +191926,7 @@ var init_provisioner_cron_sync = __esm({
     "use strict";
     init_postgres_temporal2();
     init_platform_scheduled_job_secret();
+    init_platform_scheduled_job_secret();
     PLATFORM_SECRET = process.env.PLATFORM_INTERNAL_SECRET || process.env.BETTER_AUTH_SECRET || "gencow-default-secret";
     MAX_CRON_JOBS_FREE = 5;
     CRON_MANIFEST_RELATIVE_PATH = ".gencow/cron-jobs.json";
@@ -430467,6 +430504,7 @@ __export(provisioner_exports, {
   hasLiveRuntimeProcess: () => hasLiveRuntimeProcess2,
   hasWarmPoolBytecodeBundle: () => hasWarmPoolBytecodeBundle3,
   initRunner: () => initRunner,
+  initializePlatformScheduledJobSigningSecret: () => initializePlatformScheduledJobSigningSecret,
   isManagedAppProcessCommand: () => isManagedAppProcessCommand2,
   isRunning: () => isRunning,
   listWarmPoolAssignedApps: () => listWarmPoolAssignedApps,
@@ -431158,6 +431196,9 @@ async function prepareControlPlaneCandidateWorkspace(params) {
 }
 async function buildControlPlaneCandidateEnv(params) {
   try {
+    if (!getPlatformScheduledJobSigningSecret()) {
+      capturePlatformScheduledJobSigningSecret(process.env);
+    }
     return await buildProvisionerRuntimeEnv({
       appName: params.appName,
       port: params.port,
@@ -431643,6 +431684,8 @@ var init_provisioner = __esm({
     init_provisioner_shutdown();
     init_warm_pool_backend();
     init_provisioner_cron_sync();
+    init_platform_scheduled_job_secret();
+    init_provisioner_cron_sync();
     init_provisioner_schema();
     init_migration_push_preflight_error();
     init_provisioner_wake_timing();
@@ -442214,11 +442257,8 @@ function createRuntimeRouteProjectionConverger(input) {
     return input.db.transaction(async (tx) => {
       await acquireLock(tx, `app-activation:${target.appId}`);
       const routePort = input.getAppPort(target.appName);
-      if (routePort !== void 0 && target.expectedPort !== void 0 && routePort !== target.expectedPort) {
-        throw new Error("RUNTIME_ROUTE_PROJECTION_BINDING_CHANGED");
-      }
       const [appRows, desiredRows, activationRows, instanceRows] = await Promise.all([
-        tx.select({ name: apps.name }).from(apps).where(eq68(apps.id, target.appId)),
+        tx.select({ name: apps.name, catalogPort: apps.port }).from(apps).where(eq68(apps.id, target.appId)),
         tx.select({
           desiredActivationId: appRuntimeDesiredState.desiredActivationId,
           desiredRuntimeState: appRuntimeDesiredState.desiredRuntimeState,
@@ -442261,6 +442301,10 @@ function createRuntimeRouteProjectionConverger(input) {
       const servingWithoutInstance = desired?.desiredRuntimeState === "serving" && desired.nodeId === input.currentNodeId && desired.desiredActivationId !== null && activationRows.some((activation) => activation.id === desired.desiredActivationId) && !instanceRows.some(
         (instance) => instance.activationEpoch === desired.activationEpoch && instance.state === "serving"
       );
+      const staleCatalogRoutePort = desiredAbsentOnNode && routePort !== void 0 && target.expectedPort !== void 0 && routePort !== target.expectedPort && appRows[0]?.catalogPort === routePort;
+      if (routePort !== void 0 && target.expectedPort !== void 0 && routePort !== target.expectedPort && !staleCatalogRoutePort) {
+        throw new Error("RUNTIME_ROUTE_PROJECTION_BINDING_CHANGED");
+      }
       if (desired?.authorityMode !== "enforce" || !desiredAbsentOnNode && !desiredMovedFromNode && !stoppedDeletionProjection && !servingWithoutInstance) {
         throw new Error("RUNTIME_ROUTE_PROJECTION_STATE_AMBIGUOUS");
       }
@@ -446822,11 +446866,11 @@ async function probeSlotCapability(input) {
         method: "GET",
         path: path4
       }),
-      signal: AbortSignal.timeout(750)
+      signal: AbortSignal.timeout(input.timeoutMs ?? DEFAULT_SLOT_CAPABILITY_PROBE_TIMEOUT_MS)
     });
     if (response.status === 404 && input.port !== input.currentPort) {
       const readiness = await input.fetchImpl(`${origin}/health/ready`, {
-        signal: AbortSignal.timeout(750)
+        signal: AbortSignal.timeout(input.timeoutMs ?? DEFAULT_SLOT_CAPABILITY_PROBE_TIMEOUT_MS)
       });
       return readiness.ok ? "legacy" : "unavailable";
     }
@@ -446880,7 +446924,10 @@ async function convergeDeploymentRouteAcrossEligibleSlots(input) {
         env: env2,
         boundNodeOrigin: boundNodeOrigin?.origin
       };
-      const capability2 = port === currentPort ? await probeCurrentSlotCapabilityWithRetry(probeInput) : await probeSlotCapability(probeInput);
+      const capability2 = port === currentPort && input.currentSlotKnownCapable ? "capable" : port === currentPort ? await probeCurrentSlotCapabilityWithRetry(probeInput) : await probeSlotCapability({
+        ...probeInput,
+        timeoutMs: input.currentSlotKnownCapable ? KNOWN_CURRENT_SLOT_SIBLING_PROBE_TIMEOUT_MS : void 0
+      });
       return { port, capability: capability2 };
     })
   );
@@ -446934,12 +446981,14 @@ async function convergeDeploymentRouteAcrossEligibleSlots(input) {
   }
   return { routeConvergence: "converged", acknowledgedSlots };
 }
-var DEFAULT_PLATFORM_GATEWAY_ENV_FILE;
+var DEFAULT_PLATFORM_GATEWAY_ENV_FILE, DEFAULT_SLOT_CAPABILITY_PROBE_TIMEOUT_MS, KNOWN_CURRENT_SLOT_SIBLING_PROBE_TIMEOUT_MS;
 var init_runtime_route_fleet_client = __esm({
   "../platform/src/runtime-route-fleet-client.ts"() {
     "use strict";
     init_node_proxy_signature();
     DEFAULT_PLATFORM_GATEWAY_ENV_FILE = "/etc/gencow/platform-internal-gateway.env";
+    DEFAULT_SLOT_CAPABILITY_PROBE_TIMEOUT_MS = 750;
+    KNOWN_CURRENT_SLOT_SIBLING_PROBE_TIMEOUT_MS = 250;
   }
 });
 
@@ -447364,6 +447413,7 @@ async function restartRetainedRuntimeActivation(input) {
         })
       );
       await convergeDeploymentRouteAcrossEligibleSlots({
+        currentSlotKnownCapable: true,
         binding: buildCanonicalTenantRouteBinding({
           appId: current.appId,
           appName: current.appName,
@@ -447444,21 +447494,27 @@ var init_runtime_retained_activation_recovery = __esm({
 });
 
 // ../platform/src/runtime-retained-activation-wake.ts
+function retainedActivationRestartOwnsServingRoute(restoreOperationId) {
+  return !restoreOperationId;
+}
 function createRetainedActivationWakeAction(input) {
   return (snapshot) => {
     const restoreOperationId = deleteRestoreOperationIdForApp(input.recoveryCommand, snapshot.appId);
     return restartRetainedActivationWithFallback({
       restoreOperationId,
-      restart: () => observeRuntimeWakePhase(
-        currentRuntimeWakePhaseTrace(),
-        { phase: "retained_activation_restart", failureReason: "phase_failed" },
-        () => restartRetainedRuntimeActivation({
-          db: input.db,
-          snapshot,
-          currentNodeId: input.currentNodeId,
-          restoreOperationId
-        })
-      ),
+      restart: async () => {
+        await observeRuntimeWakePhase(
+          currentRuntimeWakePhaseTrace(),
+          { phase: "retained_activation_restart", failureReason: "phase_failed" },
+          () => restartRetainedRuntimeActivation({
+            db: input.db,
+            snapshot,
+            currentNodeId: input.currentNodeId,
+            restoreOperationId
+          })
+        );
+        return retainedActivationRestartOwnsServingRoute(restoreOperationId) ? { retainedActivationRestartCompleted: true } : void 0;
+      },
       restore: (operationId2) => input.replaceCurrentDeployment(snapshot, "restore_exact_generation", void 0, operationId2)
     });
   };
@@ -450353,6 +450409,35 @@ async function planExplicitRuntimeStop(input) {
         if (!reset[0]) throw new Error("RUNTIME_EXPLICIT_STOP_RETRY_CAS_FAILED");
       }
     }
+    const matchingActiveDrain = (await tx.execute(sql140`
+        SELECT d.lifecycle_request_id, r.correlation_id, d.id AS drain_id, d.activation_id, d.instance_id FROM runtime_drain_requests d
+        JOIN runtime_lifecycle_requests r ON r.id = d.lifecycle_request_id
+        WHERE d.app_id = ${input.appId}
+          AND d.activation_id = ${activation.id}
+          AND d.instance_id = ${instance.instanceId}
+          AND d.reason = 'app_delete'
+          AND d.state IN ('planned', 'armed', 'dispatched')
+          AND r.action = ${input.reason}
+          AND (r.actor_kind = ${input.actorKind} OR (${input.reason === "app_delete" && input.actorKind === "owner" && input.correlationId.startsWith("app_delete_")} AND r.actor_kind = 'platform'))
+          AND r.actor_id_hash = ${actorIdHash}
+          AND (r.correlation_id = ${input.correlationId} OR (${input.reason === "app_delete" && input.correlationId.startsWith("app_delete_")} AND r.correlation_id LIKE ${`lifecycle_app_delete_${input.appId}_%`}))
+        LIMIT 1
+      `)).rows?.[0];
+    if (matchingActiveDrain) {
+      return {
+        appId: input.appId,
+        appName: input.appName,
+        activationId: matchingActiveDrain.activation_id,
+        instanceId: matchingActiveDrain.instance_id,
+        lifecycleRequestId: matchingActiveDrain.lifecycle_request_id,
+        drainId: matchingActiveDrain.drain_id,
+        reason: input.reason,
+        actorKind: input.actorKind,
+        actorIdHash,
+        correlationId: matchingActiveDrain.correlation_id,
+        replayed: true
+      };
+    }
     const activeDrains = await tx.select().from(runtimeDrainRequests).where(
       and90(
         eq97(runtimeDrainRequests.appId, input.appId),
@@ -453676,6 +453761,9 @@ function isDeferredActionDecision(decision) {
 function isRuntimeArtifactTerminalization(value) {
   return typeof value === "object" && value !== null && value.terminalized === true && value.terminalization === "runtime_artifact_unavailable";
 }
+function isRetainedActivationRestartCompleted(value) {
+  return typeof value === "object" && value !== null && value.retainedActivationRestartCompleted === true;
+}
 async function reconcileRuntimeControlPlaneApp(input) {
   const snapshot = await input.loadSnapshot(input.appId);
   if (snapshot.appId !== input.appId) throw new Error("CONTROL_PLANE_SNAPSHOT_SCOPE_MISMATCH");
@@ -453710,6 +453798,9 @@ async function reconcileRuntimeControlPlaneApp(input) {
   await input.acquireLock(input.appId, async (lockedDb) => {
     await input.recordDecision?.({ appId: input.appId, ...settled }, lockedDb);
   });
+  if (deferredAction.result.decision === "restart_retained_activation" && isRetainedActivationRestartCompleted(actionResult)) {
+    return { ...settled, retainedActivationRestartCompleted: true };
+  }
   return settled;
 }
 var init_runtime_reconciliation_controller = __esm({
@@ -455779,7 +455870,7 @@ function publicAppDeleteErrorCode(error51) {
   const code = stableAppDeleteErrorCode(error51);
   return PUBLICLY_NORMALIZED_APP_DELETE_CODES.has(code) ? "APP_DELETE_OPERATION_PENDING" : code;
 }
-function appDeleteFailureWithReceipt(error51, receipt) {
+function appDeleteFailureWithReceipt(error51, receipt, statusQueryName = "apps.deleteStatus") {
   const code = publicAppDeleteErrorCode(error51);
   const restorationDiagnostic = code === "APP_DELETE_RESTORE_IN_PROGRESS" ? {
     stateImpact: "The same restore receipt remains active; no replacement delete or restore operation was created.",
@@ -455795,6 +455886,13 @@ function appDeleteFailureWithReceipt(error51, receipt) {
     retryClass: "owner-action",
     userAction: "RETRY_DELETE_WITH_NEW_REQUEST",
     nextAction: "RETRY_DELETE_WITH_NEW_REQUEST"
+  } : statusQueryName === "admin.apps.deleteStatus" ? {
+    stateImpact: "The same delete operation remains authoritative; no replacement operation was created.",
+    retryable: false,
+    retryPrecondition: `The administrator must POST /api/query with {"name":"${statusQueryName}","args":{"name":"<app>","operationId":"<operationId>"}} and wait for deletion to reach a terminal state.`,
+    retryClass: "platform-action",
+    userAction: "VIEW_DELETE_STATUS",
+    nextAction: "VIEW_DELETE_STATUS"
   } : {};
   return Object.assign(new Error(code, { cause: error51 }), {
     code,
@@ -458907,7 +459005,7 @@ async function bootstrapPlatformRuntime(params) {
   const { buildAppRuntimeUnavailableResult, ensureAppRuntimeReady } = await import(resolve124(params.functionsPath, "../src/app-runtime-recovery.ts"));
   const { createPublicRuntimeWakeCorrelation, executeLegacyRuntimeWakeByName } = await import(resolve124(params.functionsPath, "../src/simple-lifecycle/legacy-runtime-effect-adapter.ts"));
   await initializePlatformRuntimeGenerationForServer(params.functionsPath);
-  const { getAppPort: getLivePort, setAppPort: setAppPort2, removeAppPort: removeAppPort2, removeAppPortIfEquals: removeAppPortIfEquals2, setAppMeta: setAppMeta2, setLastAccess: markLastAccess, hasLiveRuntimeProcess: hasLiveRuntimeProcess3, resolveLiveRuntimePort: resolveLiveRuntimePort3, reapWarmPoolStale: reapWarmPoolStale2, getWakeCapacitySnapshot: getWakeCapacitySnapshot2, setWakeCapacityMaxConcurrentRunning: setWakeCapacityMaxConcurrentRunning2, setWakeCapacityUpdateInProgress: setWakeCapacityUpdateInProgress2, generateInternalToken: generateInternalToken3, setDatabasePreflightRawSql: setDatabasePreflightRawSql2, setPlatformRuntimeDb: setPlatformRuntimeDb2, buildAppDatabaseUrl: buildAppDatabaseUrl2 } = await import(resolve124(params.functionsPath, "../src/provisioner.ts"));
+  const { getAppPort: getLivePort, setAppPort: setAppPort2, removeAppPort: removeAppPort2, removeAppPortIfEquals: removeAppPortIfEquals2, setAppMeta: setAppMeta2, setLastAccess: markLastAccess, hasLiveRuntimeProcess: hasLiveRuntimeProcess3, resolveLiveRuntimePort: resolveLiveRuntimePort3, reapWarmPoolStale: reapWarmPoolStale2, getWakeCapacitySnapshot: getWakeCapacitySnapshot2, setWakeCapacityMaxConcurrentRunning: setWakeCapacityMaxConcurrentRunning2, setWakeCapacityUpdateInProgress: setWakeCapacityUpdateInProgress2, generateInternalToken: generateInternalToken3, setDatabasePreflightRawSql: setDatabasePreflightRawSql2, setPlatformRuntimeDb: setPlatformRuntimeDb2, buildAppDatabaseUrl: buildAppDatabaseUrl2 } = await loadPlatformProvisionerWithScheduledJobSigningSecret(() => import(resolve124(params.functionsPath, "../src/provisioner.ts")));
   setDatabasePreflightRawSql2(params.rawSql);
   wirePlatformDatabaseUrls(setPlatformRuntimeDb2, params.db, params.databaseUrlResolvers);
   const storageDirectRuntime = await createPlatformStorageDirectRuntime(params.functionsPath, buildAppDatabaseUrl2);
@@ -459336,6 +459434,7 @@ var init_server_platform_runtime_bootstrap = __esm({
     init_server_platform_control_plane_observer_runtime();
     init_server_platform_cron_scheduler();
     init_server_scheduled_jobs_runtime();
+    init_platform_scheduled_job_secret();
     init_server_execution();
     init_server_wake_signal_diagnostics_route();
     init_server_platform_worker_diagnostics();
@@ -465643,6 +465742,7 @@ var SAFE_DIAGNOSTIC_STATE_IMPACTS = /* @__PURE__ */ new Set([
   "Runtime reconciliation made no state change; the existing delete operation remains authoritative.",
   "The failed delete receipt remains unchanged; the app runtime was not started.",
   "The same restore receipt remains active; no replacement delete or restore operation was created.",
+  "The same delete operation remains authoritative; no replacement operation was created.",
   "The previous restore is complete; this request did not create a delete operation.",
   "No matching upload grant was found; no storage catalog object was finalized.",
   "The upload grant is expired or aborted; no storage catalog object was finalized.",
@@ -465666,6 +465766,7 @@ var SAFE_DIAGNOSTIC_RETRY_PRECONDITIONS = /* @__PURE__ */ new Set([
   "Refresh the app list before retrying with the same request ID.",
   "Refresh the app list to confirm whether the app is already removed.",
   'The owner must POST /api/query with {"name":"apps.deleteStatus","args":{"name":"<app>","operationId":"<operationId>"}} and wait for deletion to reach a terminal state.',
+  'The administrator must POST /api/query with {"name":"admin.apps.deleteStatus","args":{"name":"<app>","operationId":"<operationId>"}} and wait for deletion to reach a terminal state.',
   "Wait until the stated runtime or serving-route condition is clear, then retry the same owner wake/resume operation.",
   "Wait until the active app deployment attempt finishes and its lease clears; then retry the same owner wake.",
   "Wait until this restore receipt leaves restoring; then check the app status.",